GitHub Repository Collaborator Change

AnalysisType: rule
Filename: github_repo_collaborator_change.py
RuleID: "Github.Repo.CollaboratorChange"
DisplayName: "GitHub Repository Collaborator Change"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Severity: Medium
Description: Detects when a repository collaborator is added or removed.
Runbook: Determine if the new collaborator is authorized to access the repository.
Reference: https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-an-individuals-access-to-an-organization-repository
Tests:
  - Name: GitHub - Collaborator Added
    ExpectedResult: true
    Log:
      {
        "actor": "bob",
        "action": "repo.add_member",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
        "user": "cat",
      }
  - Name: GitHub - Collaborator Removed
    ExpectedResult: true
    Log:
      {
        "actor": "bob",
        "action": "repo.remove_member",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
        "user": "cat",
      }
  - Name: GitHub - Non member action
    ExpectedResult: false
    Log:
      {
        "actor": "bob",
        "action": "repo.enable",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
        "user": "cat",
      }


# ------ paired body: github_repo_collaborator_change.py ------

def rule(event):

    return event.get("action") in ("repo.add_member", "repo.remove_member")


def title(event):
    repo_link = f"https://github.com/{event.get('repo','<UNKNOWN_REPO>')}/settings/access"
    action = "added to"
    if event.get("action") == "repo.remove_member":
        action = "removed from"
    return (
        f"Repository collaborator [{event.get('user', '<UNKNOWN_USER>')}] {action} "
        f"repository {event.get('repo', '<UNKNOWN_REPO>')}. "
        f"View current collaborators here: {repo_link}"
    )


def severity(event):
    if event.get("action") == "repo.remove_member":
        return "INFO"
    return "MEDIUM"