Panther informational experimental python

GitHub Team Modified

Detects when a team is modified in some way, such as adding a new team, deleting a team, modifying members, or a change in repository control.

View Source

Detection Logic

def rule(event):

    if not event.get("action").startswith("team"):
        return False
    return (
        event.get("action") == "team.add_member"
        or event.get("action") == "team.add_repository"
        or event.get("action") == "team.change_parent_team"
        or event.get("action") == "team.create"
        or event.get("action") == "team.destroy"
        or event.get("action") == "team.remove_member"
        or event.get("action") == "team.remove_repository"
    )


def title(event):
    team_name = event.get("team") if "team" in event else "<MISSING_TEAM>"
    return f"GitHub.Audit: [{team_name}] has been modified"

Field Validations

Loading…

Comments (0)

Loading comments...