GitHub Audit: Dependabot Alerts and Security Updates Disabled
Flags GitHub audit events where Dependabot alerts or security updates are disabled for an organization or repositories.
- Product
- github
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-01-27
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub audit log events where Dependabot alerts or Dependabot security updates are disabled, including for private repositories or across all repositories. Disabling these alerts can prevent detection and remediation of vulnerable or outdated dependencies, reducing an organization’s security visibility. The detection relies on GitHub audit log entries capturing the specific disable actions and the associated actor who performed the change.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
- docs.github.comhttps://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "GitHub Audit: Dependabot Alerts and Security Updates Disabled"
id: 50217dbe-88d3-4c48-b6bc-3f597771d8ba
status: test
description: This rule flags GitHub audit log events where Dependabot alerts or Dependabot security updates are disabled, including for private repositories or across all repositories. Disabling these alerts can prevent detection and remediation of vulnerable or outdated dependencies, reducing an organization’s security visibility. The detection relies on GitHub audit log entries capturing the specific disable actions and the associated actor who performed the change.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-27
references:
- https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml
tags:
- attack.initial-access
- attack.t1195.001
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- dependabot_alerts_new_repos.disable
- dependabot_alerts.disable
- dependabot_security_updates_new_repos.disable
- dependabot_security_updates.disable
- repository_vulnerability_alerts.disable
condition: selection
falsepositives:
- Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes.
level: high
license: DRL-1.1
related:
- id: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d
type: derived