GitHub Dependabot Alerts or Security Updates Disabled

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GitHub Dependabot Alerts or Security Updates Disabled

Detects when Dependabot alerts or security updates are disabled at the repository, organization, or enterprise level in GitHub. Adversaries may turn off Dependabot to reduce the chance that a malicious or vulnerable dependency they introduced is flagged; disabling it for an organization or enterprise removes this coverage across many repositories at once.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide

Tags:

Domain: Cloud
Domain: SaaS
Platform: GitHub
Use Case: Threat Detection
Tactic: Defense Evasion
Data Source: Github
Data Source: GitHub Audit Logs
Rule Type: ESQL
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GitHub Dependabot Alerts or Security Updates Disabled

Disabling Dependabot removes automated visibility into vulnerable and malicious packages. This can precede a supply-chain commit or lockfile change. Repository-level actions affect a single repo, while dependabot_* (organization) and business_dependabot_* (enterprise) actions remove coverage across many repositories at once.

Possible investigation steps

Identify user.name, github.org, github.repo, event.action, and github.programmatic_access_type, and note whether the action is repository-, organization-, or enterprise-scoped.
Review commits and dependency manifest changes around the disable timestamp.
Check whether Secret Scanning, code scanning, or the org security configuration were also changed.
Re-enable Dependabot unless there is an approved exception.

False positive analysis

Bulk disable on forks, mirrors, or documentation-only repositories.
Org-policy automation that detaches a security configuration.

Response and remediation

Re-enable Dependabot alerts (and security updates if required by policy).
Audit recently added dependencies and workflow files.
Rotate credentials if the actor is not a known admin.

Rule query

edit

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "repository_vulnerability_alerts.disable",
      "repository_security_updates.disable",
      "dependabot_alerts.disable",
      "dependabot_alerts_new_repos.disable",
      "dependabot_security_updates.disable",
      "dependabot_security_updates_new_repos.disable",
      "business_dependabot_alerts.disable",
      "business_dependabot_alerts_new_repos.disable"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/

« GitHub Advanced Security Disabled GitHub IP Allow List Modified »