Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

GitHub UEBA - Multiple Alerts from a GitHub Account

This rule is part of the "GitHub UEBA - Unusual Activity from Account Pack", and leverages alert data to determine when multiple alerts are executed by the same user in a timespan of one hour. Analysts can use this to prioritize triage and response, as these alerts are a higher indicator of compromised user accounts or PATs.

ATT&CK coverage

This detection is not mapped to any ATT&CK technique.

Detection requirements

Log source category: event_index

What the source says

Tagged by the source as

Data Source: GithubDomain: CloudResources: Investigation GuideRule Type: Higher-Order RuleTactic: ExecutionUse Case: Threat DetectionUse Case: UEBA

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.