GitHub Team Modified

AnalysisType: rule
Filename: github_team_modified.py
RuleID: "GitHub.Team.Modified"
DisplayName: "GitHub Team Modified"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Reference: https://docs.github.com/en/organizations/organizing-members-into-teams
Severity: Info
Description: Detects when a team is modified in some way, such as adding a new team, deleting a team, modifying members, or a change in repository control.
Tests:
  - Name: GitHub - Team Deleted
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "team.destroy",
        "created_at": 1621305118553,
        "data": { "team": "my-org/my-team" },
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }
  - Name: GitHub - Team Created
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "team.create",
        "created_at": 1621305118553,
        "data": { "team": "my-org/my-team" },
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }
  - Name: GitHub - Team Add repository
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "team.add_repository",
        "created_at": 1621305118553,
        "data": { "team": "my-org/my-team" },
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }


# ------ paired body: github_team_modified.py ------

def rule(event):

    if not event.get("action").startswith("team"):
        return False
    return (
        event.get("action") == "team.add_member"
        or event.get("action") == "team.add_repository"
        or event.get("action") == "team.change_parent_team"
        or event.get("action") == "team.create"
        or event.get("action") == "team.destroy"
        or event.get("action") == "team.remove_member"
        or event.get("action") == "team.remove_repository"
    )


def title(event):
    team_name = event.get("team") if "team" in event else "<MISSING_TEAM>"
    return f"GitHub.Audit: [{team_name}] has been modified"