Github Public Repository Created

AnalysisType: rule
Description: A public Github repository was created.
DisplayName: "Github Public Repository Created"
Enabled: true
Filename: github_public_repository_created.py
Runbook: Confirm this github repository was intended to be created as 'public' versus 'private'.
Reference: https://docs.github.com/en/get-started/quickstart/create-a-repo
Severity: Medium
Tags:
  - Github Repository
  - Public
  - Repository Created
Tests:
  - ExpectedResult: true
    Log:
      _document_id: abCD
      action: repo.create
      actor: example-actor
      actor_location:
        country_code: US
      at_sign_timestamp: "2022-12-11 22:40:20.268"
      created_at: "2022-12-11 22:40:20.268"
      org: example-io
      repo: example-io/oops
      visibility: public
    Name: Public Repo Created
  - ExpectedResult: false
    Log:
      _document_id: abCD
      action: repo.create
      actor: example-actor
      actor_location:
        country_code: US
      at_sign_timestamp: "2022-12-11 22:40:20.268"
      created_at: "2022-12-11 22:40:20.268"
      org: example-io
      repo: example-io/oops
      visibility: private
    Name: Private Repo Created
DedupPeriodMinutes: 60
LogTypes:
  - GitHub.Audit
RuleID: "Github.Public.Repository.Created"
SummaryAttributes:
  - actor
  - repository
  - visibility
Threshold: 1


# ------ paired body: github_public_repository_created.py ------

from panther_github_helpers import github_alert_context


def rule(event):

    # Return True if a public repository was created
    return event.get("action", "") == "repo.create" and event.get("visibility", "") == "public"


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method
    # will act as deduplication string.
    return (
        f"Repository [{event.get('repo', '<UNKNOWN_REPO>')}] "
        f"created with public status by Github user [{event.get('actor')}]."
    )


# def dedup(event):
#  (Optional) Return a string which will be used to deduplicate similar alerts.
# return ''


def alert_context(event):
    #  (Optional) Return a dictionary with additional data to be included in the alert
    # sent to the SNS/SQS/Webhook destination
    return github_alert_context(event)