Panther high experimental python

GitHub User Role Updated

Detects when a GitHub user role is upgraded to an admin or downgraded to a member

View Source

Detection Logic

def rule(event):

    return event.get("action") == "org.update_member"


def title(event):
    return (
        f"Org owner [{event.udm('actor_user')}] updated user's "
        f"[{event.get('user')}] role ('admin' or 'member')"
    )

Field Validations

Loading…

Comments (0)

Loading comments...