Outdated Dependency Or Vulnerability Alert Disabled
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Definition
Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming
detection:
selection:
action:
- 'dependabot_alerts_new_repos.disable'
- 'dependabot_alerts.disable'
- 'dependabot_security_updates_new_repos.disable'
- 'dependabot_security_updates.disable'
- 'repository_vulnerability_alerts.disable'
condition: selectionApproved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes.