Elastic Security Detection Rules

GitHub Dependabot Alerts or Security Updates Disabled

Last updated a day ago on 2026-11-02
Created a day ago on 2026-11-02

About

Detects when Dependabot alerts or security updates are disabled at the repository, organization, or enterprise level in GitHub. Adversaries may turn off Dependabot to reduce the chance that a malicious or vulnerable dependency they introduced is flagged; disabling it for an organization or enterprise removes this coverage across many repositories at once.
Tags
Domain: CloudDomain: SaaSPlatform: GitHubUse Case: Threat DetectionTactic: Defense EvasionData Source: GithubData Source: GitHub Audit LogsRule Type: ESQLLanguage: esql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples
Repository admins disabling Dependabot on archival, template, or non-code repos. Confirm the change was intended and that production application repos remain covered.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

github(external, opens in a new tab or window)

Query
text code block:
from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "repository_vulnerability_alerts.disable",
      "repository_security_updates.disable",
      "dependabot_alerts.disable",
      "dependabot_alerts_new_repos.disable",
      "dependabot_security_updates.disable",
      "dependabot_security_updates_new_repos.disable",
      "business_dependabot_alerts.disable",
      "business_dependabot_alerts_new_repos.disable"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent

Install detection rules in Elastic Security

Detect GitHub Dependabot Alerts or Security Updates Disabled in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).