Sigma rule: Outdated Dependency Or Vulnerability Alert Disabled

Rule

Title

Outdated Dependency Or Vulnerability Alert Disabled

Status

test

Level

high

Author

Muhammad Faisal (@faisalusuf)

Date

2023-01-27

File

rules/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

Log source

product

github

service

audit

definition

Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming

Detection

selection:
    action:
        - 'dependabot_alerts_new_repos.disable'
        - 'dependabot_alerts.disable'
        - 'dependabot_security_updates_new_repos.disable'
        - 'dependabot_security_updates.disable'
        - 'repository_vulnerability_alerts.disable'
condition: selection

False positives (as the rule lists them)

• Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes.

Tags

• attack.initial-access
• attack.t1195.001

MITRE ATT&CK ids this rule names

• T1195.001

References

• https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
• https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml