This rule detects protected branch setting changes on a GitHub repository originating from a user agent not previously seen performing protected branch changes in the last 7 days. Branch protection rules enforce workflows and requirements before a contributor can push changes to a branch. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks. Both push-time enforcement events (`protected_branch.rejected_ref_update`, a push blocked by branch protection) and administrative bypasses (`protected_branch.policy_override`) are retained, because a failed modification attempt and an admin override are each security-relevant indicators, particularly during CI/CD compromise once administrative access is obtained. Keying on a new user agent suppresses the recurring, expected automation that drives most of the event volume while surfacing changes from unfamiliar tooling or clients. If a specific user agent is noisy in a given environment, scope it with an exception rather than removing the action from the query.