Panther medium experimental python

GitHub User Added to Org Moderators

Detects when a user is added to a GitHub org's list of moderators.

View Source

Detection Logic

from panther_github_helpers import github_alert_context


def rule(event):

    return event.get("action") == "organization_moderators.add_user"


def title(event):
    return (
        f"GitHub.Audit: User [{event.get('actor', '<UNKNOWN_ACTOR>')}] added user "
        f"[{event.get('user', '<UNKNOWN_USER>')}] to moderators in "
        f"[{event.get('org','<UNKNOWN_ORG>')}]"
    )


def alert_context(event):
    return github_alert_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...