GitHub User Added or Removed from Org

AnalysisType: rule
Filename: github_org_modified.py
RuleID: "GitHub.Org.Modified"
DisplayName: "GitHub User Added or Removed from Org"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Reference: https://docs.github.com/en/organizations/managing-membership-in-your-organization
Severity: Info
Description: Detects when a user is added or removed from a GitHub Org.
Tests:
  - Name: GitHub - Team Deleted
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "team.destroy",
        "created_at": 1621305118553,
        "data": { "team": "my-org/my-team" },
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }
  - Name: GitHub - Org - User Added
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "org.add_member",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "user": "cat",
      }
  - Name: GitHub - Org - User Removed
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "org.remove_member",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "user": "bob",
      }


# ------ paired body: github_org_modified.py ------

def rule(event):

    return event.get("action") == "org.add_member" or event.get("action") == "org.remove_member"


def title(event):
    action = event.get("action")
    if event.get("action") == "org.add_member":
        action = "added"
    elif event.get("action") == "org.remove_member":
        action = "removed"
    return (
        f"GitHub.Audit: User [{event.udm('actor_user')}] {action} "
        f"{event.get('user', '<UNKNOWN_USER>')} to org [{event.get('org','<UNKNOWN_ORG>')}]"
    )