GitHubAuditData
| where Action == "payment_method.remove"
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
query: |
GitHubAuditData
| where Action == "payment_method.remove"
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
triggerThreshold: 0
status: Available
version: 1.0.1
requiredDataConnectors: []
relevantTechniques:
- T1078
queryFrequency: 1d
triggerOperator: gt
kind: Scheduled
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Actor
- identifier: Name
columnName: AccountName
- identifier: UPNSuffix
columnName: AccountUPNSuffix
description: |
'Detect activities when a payment method was removed. This query runs every day and its severity is Medium.'
severity: Medium
tactics:
- InitialAccess
name: (Preview) GitHub - A payment method was removed
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/(Preview) GitHub - A payment method was removed.yaml
id: 6bb50582-caac-4a9b-9afb-3fee766ebbf7
queryPeriod: 7d
