GitHub User Role Updated

AnalysisType: rule
Filename: github_user_role_updated.py
RuleID: "GitHub.User.RoleUpdated"
DisplayName: "GitHub User Role Updated"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Persistence:Account Manipulation
Reports:
  MITRE ATT&CK:
    - TA0003:T1098
Reference: https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization
Severity: High
Description: Detects when a GitHub user role is upgraded to an admin or downgraded to a member
Tests:
  - Name: GitHub - Member Updated
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "org.update_member",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
        "user": "bob",
      }
  - Name: GitHub - Member Invited
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "org.invite_member",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
        "user": "bob",
      }


# ------ paired body: github_user_role_updated.py ------

def rule(event):

    return event.get("action") == "org.update_member"


def title(event):
    return (
        f"Org owner [{event.udm('actor_user')}] updated user's "
        f"[{event.get('user')}] role ('admin' or 'member')"
    )