GitHub Org IP Allow List modified

AnalysisType: rule
Filename: github_org_ip_allowlist.py
RuleID: "GitHub.Org.IpAllowlist"
DisplayName: "GitHub Org IP Allow List modified"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Persistence:Account Manipulation
Reports:
  MITRE ATT&CK:
    - TA0003:T1098
Severity: Medium
SummaryAttributes:
  - actor
  - action
Description: Detects changes to a GitHub Org IP Allow List
Runbook: Verify that the change was authorized and appropriate.
Reference: https://docs.github.com/en/apps/maintaining-github-apps/managing-allowed-ip-addresses-for-a-github-app
Tests:
  - Name: GitHub - IP Allow list modified
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "ip_allow_list_entry.create",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "org": "my-org",
      }
  - Name: GitHub - IP Allow list disabled
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "ip_allow_list.disable",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
      }
  - Name: GitHub - Non IP Allow list action
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "org.invite_user",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
      }


# ------ paired body: github_org_ip_allowlist.py ------

ALLOWLIST_ACTIONS = [
    "ip_allow_list.enable",
    "ip_allow_list.disable",
    "ip_allow_list.enable_for_installed_apps",
    "ip_allow_list.disable_for_installed_apps",
    "ip_allow_list_entry.create",
    "ip_allow_list_entry.update",
    "ip_allow_list_entry.destroy",
]


def rule(event):

    return (
        event.get("action").startswith("ip_allow_list") and event.get("action") in ALLOWLIST_ACTIONS
    )


def title(event):
    return f"GitHub Org IP Allow list modified by {event.get('actor')}."