diff --git a/rules/integrations/github/impact_github_repository_deleted.toml b/rules/integrations/github/impact_github_repository_deleted.toml index 287db18a7c2..614e7ade0fc 100644 --- a/rules/integrations/github/impact_github_repository_deleted.toml +++ b/rules/integrations/github/impact_github_repository_deleted.toml @@ -2,7 +2,7 @@ creation_date = "2023/08/29" integration = ["github"] maturity = "production" -updated_date = "2024/11/27" +updated_date = "2024/12/03" min_stack_version = "8.12.0" min_stack_comments = "Breaking change at 8.12.0 for the Github Integration." @@ -33,7 +33,7 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -configuration where event.module == "github" and event.action == "repo.destroy" +configuration where event.module == "github" and event.dataset == "github.audit" and event.action == "repo.destroy" '''