GitHub User Blocked From Organization Repositories

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•27

This rule detects when a user is blocked from accessing repositories within a GitHub organization. This event is captured from GitHub's audit logs and specifically looks for the 'org.block_user' event type. The rule identifies both the actor who performed the blocking action and the target user who was blocked.