Add event dataset for missing rule in Github integration (#4278)

(cherry picked from commit 53cfeb7)
elastic · Dec 3, 2024 · 7b7b2e2 · 7b7b2e2
1 parent 8287dfd
commit 7b7b2e2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/integrations/github/impact_github_repository_deleted.toml b/rules/integrations/github/impact_github_repository_deleted.toml
@@ -2,7 +2,7 @@
 creation_date = "2023/08/29"
 integration = ["github"]
 maturity = "production"
-updated_date = "2024/11/27"
+updated_date = "2024/12/03"
 min_stack_version = "8.12.0"
 min_stack_comments = "Breaking change at 8.12.0 for the Github Integration."
 
@@ -33,7 +33,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-configuration where event.module == "github" and event.action == "repo.destroy"
+configuration where event.module == "github" and event.dataset == "github.audit" and event.action == "repo.destroy"
 '''