GitHub audit logs: Dependabot alerts or security updates disabled

Flags GitHub audit events where Dependabot alerts or security updates are disabled for an organization or repositories.

FreeUnreviewedSigmahighv1

github-audit-logs-dependabot-alerts-or-security-updates-disabled-34e1c7d4

title: "GitHub audit logs: Dependabot alerts or security updates disabled"
id: 50217dbe-88d3-4c48-b6bc-3f597771d8ba
status: test
description: This rule identifies when an organization owner disables Dependabot alerts for private repositories or disables Dependabot security updates across repositories. Attackers may try to reduce visibility into vulnerable dependencies by turning off automated vulnerability reporting. It relies on GitHub audit log events indicating one of the specific Dependabot disable actions.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-27
references:
  - https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml
tags:
  - attack.initial-access
  - attack.t1195.001
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - dependabot_alerts_new_repos.disable
      - dependabot_alerts.disable
      - dependabot_security_updates_new_repos.disable
      - dependabot_security_updates.disable
      - repository_vulnerability_alerts.disable
  condition: selection
falsepositives:
  - Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes.
level: high
license: DRL-1.1
related:
  - id: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d
    type: derived

What it detects

This rule identifies when an organization owner disables Dependabot alerts for private repositories or disables Dependabot security updates across repositories. Attackers may try to reduce visibility into vulnerable dependencies by turning off automated vulnerability reporting. It relies on GitHub audit log events indicating one of the specific Dependabot disable actions.

Known false positives

Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.