GitHub Enterprise Deleted

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•37

This rule detects when a GitHub enterprise is deleted. This action can lead to significant data loss and disruption of services, indicating a critical security event or a malicious act. The rule correlates the user ID and the GitHub enterprise name over a 30-minute window to identify such deletions.