GitHub User Added to Org Moderators

AnalysisType: rule
Filename: github_org_moderators_add.py
RuleID: "GitHub.Org.Moderators.Add"
DisplayName: "GitHub User Added to Org Moderators"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Severity: Medium
Description: Detects when a user is added to a GitHub org's list of moderators.
Reference: https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-moderators-in-your-organization
Tests:
  - Name: GitHub - Org Moderator Added
    ExpectedResult: true
    Log:
      {
        "_document_id": "Ab123",
        "action": "organization_moderators.add_user",
        "actor": "sarah78",
        "actor_location": { "country_code": "US" },
        "at_sign_timestamp": "2022-12-11 05:17:28.078",
        "created_at": "2022-12-11 05:17:28.078",
        "org": "example-io",
        "user": "john1987",
      }
  - Name: GitHub - Org Moderator removed
    ExpectedResult: false
    Log:
      {
        "_document_id": "Ab123",
        "action": "organization_moderators.remove_user",
        "actor": "sarah78",
        "actor_location": { "country_code": "US" },
        "at_sign_timestamp": "2022-12-11 05:17:28.078",
        "created_at": "2022-12-11 05:17:28.078",
        "org": "example-io",
        "user": "john1987",
      }


# ------ paired body: github_org_moderators_add.py ------

from panther_github_helpers import github_alert_context


def rule(event):

    return event.get("action") == "organization_moderators.add_user"


def title(event):
    return (
        f"GitHub.Audit: User [{event.get('actor', '<UNKNOWN_ACTOR>')}] added user "
        f"[{event.get('user', '<UNKNOWN_USER>')}] to moderators in "
        f"[{event.get('org','<UNKNOWN_ORG>')}]"
    )


def alert_context(event):
    return github_alert_context(event)