GitHub - User was blocked

Back


Id	0b85a077-8ba5-4cb5-90f7-1e882afe10c8
Rulename	GitHub - User was blocked
Description	Detect activities when a user was blocked on the repository. This query runs every day and its severity is Medium.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Kind	Scheduled
Query frequency	1d
Query period	7d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - User was blocked.yaml
Version	1.0.1
Arm template	0b85a077-8ba5-4cb5-90f7-1e882afe10c8.json

KQL

GitHubAuditData
| where Action == "org.block_user"
| project Actor, Action 
| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")

YAML

queryFrequency: 1d
id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c8
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - User was blocked.yaml
query: |
  GitHubAuditData
  | where Action == "org.block_user"
  | project Actor, Action 
  | extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
  | extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")  
queryPeriod: 7d
kind: Scheduled
status: Available
name: GitHub - User was blocked
triggerThreshold: 0
relevantTechniques:
- T1078
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: Actor
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
requiredDataConnectors: []
version: 1.0.1
severity: Medium
description: |
    'Detect activities when a user was blocked on the repository. This query runs every day and its severity is Medium.'
tactics:
- InitialAccess

ARM