GitHubAuditData
| where Action == "org.invite_member"
| project Actor, Action
| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")
triggerThreshold: 0
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Actor
- identifier: Name
columnName: Name
- identifier: UPNSuffix
columnName: UPNSuffix
requiredDataConnectors: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/(Preview) GitHub - User was invited to the repository.yaml
name: (Preview) GitHub - User was invited to the repository
relevantTechniques:
- T1078
status: Available
version: 1.0.1
queryPeriod: 7d
kind: Scheduled
id: 0b85a077-8ba5-4cb5-90f7-1e882afe40c9
query: |
GitHubAuditData
| where Action == "org.invite_member"
| project Actor, Action
| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")
description: |
'Detect activities when a user was invited to the repository. This query runs every day and its severity is Medium.'
queryFrequency: 1d
severity: Medium
triggerOperator: gt
tactics:
- InitialAccess
