Panther medium experimental python

GitHub Repository Collaborator Change

Detects when a repository collaborator is added or removed.

View Source

Detection Logic

def rule(event):

    return event.get("action") in ("repo.add_member", "repo.remove_member")


def title(event):
    repo_link = f"https://github.com/{event.get('repo','<UNKNOWN_REPO>')}/settings/access"
    action = "added to"
    if event.get("action") == "repo.remove_member":
        action = "removed from"
    return (
        f"Repository collaborator [{event.get('user', '<UNKNOWN_USER>')}] {action} "
        f"repository {event.get('repo', '<UNKNOWN_REPO>')}. "
        f"View current collaborators here: {repo_link}"
    )


def severity(event):
    if event.get("action") == "repo.remove_member":
        return "INFO"
    return "MEDIUM"

Field Validations

Loading…

Comments (0)

Loading comments...