Prep for Release 9.0 (#4550)

rules/integrations/github/execution_github_app_deleted.toml

@@ -2,9 +2,7 @@
 creation_date = "2023/10/11"
 integration = ["github"]
 maturity = "production"
-updated_date = "2025/01/15"
-min_stack_version = "8.13.0"
-min_stack_comments = "Breaking change at 8.13.0 for the Github Integration."
+updated_date = "2025/03/20"
 
 [rule]
 author = ["Elastic"]
@@ -14,16 +12,6 @@ index = ["logs-github.audit-*"]
 language = "eql"
 license = "Elastic License v2"
 name = "GitHub App Deleted"
-risk_score = 21
-rule_id = "fd01b949-81be-46d5-bcf8-284395d5f56d"
-severity = "low"
-tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Github", "Resources: Investigation Guide"]
-timestamp_override = "event.ingested"
-type = "eql"
-
-query = '''
-configuration where event.dataset == "github.audit" and github.category == "integration_installation" and event.type == "deletion"
-'''
 note = """## Triage and analysis
 
 > **Disclaimer**:
@@ -59,6 +47,22 @@ GitHub Apps are integrations that extend GitHub's functionality, often used to a
 - Implement additional monitoring on the affected repositories or organization to detect any further suspicious activities or attempts to delete apps.
 - Review and tighten permissions for GitHub apps to ensure only authorized personnel have the ability to delete or modify app installations.
 - Escalate the incident to higher-level security management if there is evidence of a broader compromise or if the deletion is part of a larger attack campaign."""
+risk_score = 21
+rule_id = "fd01b949-81be-46d5-bcf8-284395d5f56d"
+severity = "low"
+tags = [
+    "Domain: Cloud",
+    "Use Case: Threat Detection",
+    "Tactic: Execution",
+    "Data Source: Github",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = '''
+configuration where event.dataset == "github.audit" and github.category == "integration_installation" and event.type == "deletion"
+'''
 
 
 [[rule.threat]]