ce08b55a-f67d-4804-92b5-617b0fe5a5b5_103.json

{
    "attributes": {
        "author": [
            "Elastic"
        ],
        "building_block_type": "default",
        "description": "Detects a first occurrence event for a personal access token (PAT) not seen in the last 14 days.",
        "from": "now-9m",
        "history_window_start": "now-14d",
        "index": [
            "logs-github.audit-*"
        ],
        "language": "kuery",
        "license": "Elastic License v2",
        "name": "First Occurrence GitHub Event for a Personal Access Token (PAT)",
        "new_terms_fields": [
            "github.hashed_token",
            "event.action"
        ],
        "query": "event.dataset:\"github.audit\" and event.category:\"configuration\" and\nevent.action:* and github.hashed_token:* and \ngithub.programmatic_access_type:(\"OAuth access token\" or \"Fine-grained personal access token\")\n",
        "related_integrations": [
            {
                "package": "github",
                "version": "^2.0.0"
            }
        ],
        "required_fields": [
            {
                "ecs": true,
                "name": "event.action",
                "type": "keyword"
            },
            {
                "ecs": true,
                "name": "event.category",
                "type": "keyword"
            },
            {
                "ecs": true,
                "name": "event.dataset",
                "type": "keyword"
            },
            {
                "ecs": false,
                "name": "github.hashed_token",
                "type": "keyword"
            },
            {
                "ecs": false,
                "name": "github.programmatic_access_type",
                "type": "keyword"
            }
        ],
        "risk_score": 21,
        "rule_id": "ce08b55a-f67d-4804-92b5-617b0fe5a5b5",
        "severity": "low",
        "tags": [
            "Domain: Cloud",
            "Use Case: Threat Detection",
            "Use Case: UEBA",
            "Tactic: Execution",
            "Rule Type: BBR",
            "Data Source: Github"
        ],
        "threat": [
            {
                "framework": "MITRE ATT&CK",
                "tactic": {
                    "id": "TA0002",
                    "name": "Execution",
                    "reference": "https://attack.mitre.org/tactics/TA0002/"
                },
                "technique": [
                    {
                        "id": "T1648",
                        "name": "Serverless Execution",
                        "reference": "https://attack.mitre.org/techniques/T1648/"
                    }
                ]
            }
        ],
        "timestamp_override": "event.ingested",
        "type": "new_terms",
        "version": 103
    },
    "id": "ce08b55a-f67d-4804-92b5-617b0fe5a5b5_103",
    "type": "security-rule"
}