GitHub Advanced Security Disabled

[metadata]
creation_date = "2026/11/02"
integration = ["github"]
maturity = "production"
updated_date = "2026/11/02"

[rule]
author = ["Elastic"]
description = """
Detects GitHub Advanced Security being disabled for an enterprise, for all or new repositories in an organization, for
existing or new user-namespace repositories, or for selected members via enterprise policy. Disabling GHAS removes
secret scanning, code scanning, and related controls.
"""
false_positives = [
    """
    Cost-control or license changes that turn GHAS off for archival orgs. Confirm billing intent and that production
    orgs remain covered.
    """,
]
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "GitHub Advanced Security Disabled"
note = """## Triage and analysis

### Investigating GitHub Advanced Security Disabled

Enterprise `business_advanced_security.*` disable actions (for the business, new repositories, and existing or new user-namespace repositories) and org-level `org.advanced_security_*` disable actions (all repos, new repos, and selected-member policy) strip scanning coverage. This is separate from a single-repo `repository_secret_scanning.disable`.

### Possible investigation steps

- Identify `user.name`, `event.action`, and `github.org`.
- Check secret scanning, Dependabot, and code scanning on critical repositories.

### False positive analysis

- License downsizing with a finance ticket.

### Response and remediation

- Re-enable Advanced Security. Review commits made while scanning was off.
"""
references = ["https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security"]
risk_score = 47
rule_id = "87faf5bf-6e86-4de4-90f0-1da1e0d646f3"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Platform: GitHub",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Github",
    "Data Source: GitHub Audit Logs",
    "Rule Type: ESQL",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "business_advanced_security.disabled",
      "business_advanced_security.disabled_for_new_repos",
      "business_advanced_security.disabled_for_new_user_namespace_repos",
      "business_advanced_security.user_namespace_repos_disabled",
      "org.advanced_security_disabled_on_all_repos",
      "org.advanced_security_disabled_for_new_repos",
      "org.advanced_security_policy_selected_member_disabled"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.business
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "user.name",
    "github.org",
    "github.repo",
    "github.actor_ip",
    "github.hashed_token",
    "github.programmatic_access_type",
    "github.user_agent",
    "github.business",
]