Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
quadrantsec
/
sagan-rules
Public
Notifications
You must be signed in to change notification settings
Fork
32
Star
38
Code
Issues
2
Pull requests
0
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Actions
Projects
Security and quality
Insights
Actions: quadrantsec/sagan-rules
Actions
All workflows
Workflows
Validate Sagan Legacy Rules
Validate Sagan Legacy Rules
Show more workflows...
Management
Caches
All workflows
All workflows
Actions
Loading...
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading.
Please reload this page
.
will be ignored since log searching is not yet available
Showing runs from all workflows
will be ignored since log searching is not yet available
132 workflow runs
132 workflow runs
Workflow
Filter by Workflow
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching workflows.
Event
Filter by Event
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching events.
Status
Filter by Status
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching statuses.
Branch
Filter by Branch
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching branches.
Actor
Filter by Actor
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching users.
Merge pull request #713 from bryant-smith/split-confirmaccountcomprom…
Validate Sagan Legacy Rules
#133:
Commit
c6fddfd
pushed by
bryant-smith
14s
main
main
14s
View workflow file
Split ConfirmAccountCompromised into app- vs user-initiated rules
Validate Sagan Legacy Rules
#132:
Pull request
#713
synchronize by
bryant-smith
35s
bryant-smith:split-confirmaccountcompromised-by-initiator
bryant-smith:split-confirmaccountcompromised-by-initiator
35s
View #713
View workflow file
Split ConfirmAccountCompromised into app- vs user-initiated rules
Validate Sagan Legacy Rules
#131:
Pull request
#713
opened by
bryant-smith
10s
bryant-smith:split-confirmaccountcompromised-by-initiator
bryant-smith:split-confirmaccountcompromised-by-initiator
10s
View #713
View workflow file
Merge pull request #712 from bryant-smith/main
Validate Sagan Legacy Rules
#130:
Commit
27f7c0f
pushed by
bryant-smith
12s
main
main
12s
View workflow file
Add device-code-theft correlation and admin-confirmed-compromise rules
Validate Sagan Legacy Rules
#129:
Pull request
#712
opened by
bryant-smith
9s
bryant-smith:main
bryant-smith:main
9s
View #712
View workflow file
Merge pull request #711 from bryant-smith/tune-legacy-experimental-rules
Validate Sagan Legacy Rules
#128:
Commit
b192f37
pushed by
bryant-smith
11s
main
main
11s
View workflow file
Tune EXPERIMENTAL rules found noisy in 12h alert review
Validate Sagan Legacy Rules
#127:
Pull request
#711
opened by
bryant-smith
10s
bryant-smith:tune-legacy-experimental-rules
bryant-smith:tune-legacy-experimental-rules
10s
View #711
View workflow file
Merge pull request #710 from bryant-smith/main
Validate Sagan Legacy Rules
#126:
Commit
09297fd
pushed by
bryant-smith
9s
main
main
9s
View workflow file
Promote 24 zero-alert experimental rules to production sids
Validate Sagan Legacy Rules
#125:
Pull request
#710
opened by
bryant-smith
10s
bryant-smith:main
bryant-smith:main
10s
View #710
View workflow file
Merge pull request #709 from GeekCharmiing/feature/adjust5017821
Validate Sagan Legacy Rules
#124:
Commit
4e3ef54
pushed by
CGoggins56
14s
main
main
14s
View workflow file
Fix for bluedot logic - 5017821
Validate Sagan Legacy Rules
#123:
Pull request
#709
opened by
GeekCharmiing
12s
GeekCharmiing:feature/adjust5017821
GeekCharmiing:feature/adjust5017821
12s
View #709
View workflow file
Merge pull request #708 from GeekCharmiing/revert-707-feature/adjust5…
Validate Sagan Legacy Rules
#122:
Commit
701dac3
pushed by
CGoggins56
14s
main
main
14s
View workflow file
Revert "Adjusted rule [GCP] Google Login From Bluedot Flagged IP"
Validate Sagan Legacy Rules
#121:
Pull request
#708
opened by
GeekCharmiing
15s
GeekCharmiing:revert-707-feature/adjust5017821
GeekCharmiing:revert-707-feature/adjust5017821
15s
View #708
View workflow file
Merge pull request #707 from GeekCharmiing/feature/adjust5017821
Validate Sagan Legacy Rules
#120:
Commit
4fa8d80
pushed by
CGoggins56
13s
main
main
13s
View workflow file
Merge pull request #706 from bryant-smith/feature/o365/port-bec-cloud…
Validate Sagan Legacy Rules
#119:
Commit
fb8eb32
pushed by
CGoggins56
8s
main
main
8s
View workflow file
Adjusted rule [GCP] Google Login From Bluedot Flagged IP
Validate Sagan Legacy Rules
#118:
Pull request
#707
opened by
GeekCharmiing
14s
GeekCharmiing:feature/adjust5017821
GeekCharmiing:feature/adjust5017821
14s
View #707
View workflow file
Port 3 BEC-relevant Sagan Cloud rules to legacy (skip BAV2ROPC)
Validate Sagan Legacy Rules
#117:
Pull request
#706
opened by
bryant-smith
13s
bryant-smith:feature/o365/port-bec-cloud-rules-to-legacy
bryant-smith:feature/o365/port-bec-cloud-rules-to-legacy
13s
View #706
View workflow file
Merge pull request #705 from GeekCharmiing/promote/5017933-refresh-to…
Validate Sagan Legacy Rules
#116:
Commit
78cd449
pushed by
CGoggins56
13s
main
main
13s
View workflow file
Promote SID 5017933 to production
Validate Sagan Legacy Rules
#115:
Pull request
#705
opened by
GeekCharmiing
14s
GeekCharmiing:promote/5017933-refresh-token-replay-device-code
GeekCharmiing:promote/5017933-refresh-token-replay-device-code
14s
View #705
View workflow file
Merge pull request #704 from bryant-smith/main
Validate Sagan Legacy Rules
#114:
Commit
95525a0
pushed by
CGoggins56
12s
main
main
12s
View workflow file
fix(*): truncate json_content/json_map keys over 31 chars to match engine-stored keys
Validate Sagan Legacy Rules
#113:
Pull request
#704
opened by
bryant-smith
10s
bryant-smith:main
bryant-smith:main
10s
View #704
View workflow file
Merge pull request #703 from GeekCharmiing/feature/windows/adjust5017396
Validate Sagan Legacy Rules
#112:
Commit
b99ecfc
pushed by
CGoggins56
13s
main
main
13s
View workflow file
Thresholding for rule [WINDOWS-SECURITY] Hidden Scheduled Task Created - Critical
Validate Sagan Legacy Rules
#111:
Pull request
#703
opened by
GeekCharmiing
10s
GeekCharmiing:feature/windows/adjust5017396
GeekCharmiing:feature/windows/adjust5017396
10s
View #703
View workflow file
Fixed rule [WINDOWS-SECURITY] Hidden Scheduled Task Created - Critical
Validate Sagan Legacy Rules
#110:
Pull request
#701
synchronize by
GeekCharmiing
12s
GeekCharmiing:feature/windows/adjust5017396
GeekCharmiing:feature/windows/adjust5017396
12s
View #701
View workflow file
Merge pull request #701 from GeekCharmiing/feature/windows/adjust5017396
Validate Sagan Legacy Rules
#109:
Commit
656be7a
pushed by
CGoggins56
33s
main
main
33s
View workflow file
Previous
1
2
3
4
5
6
Next
You can’t perform that action at this time.