GitHub Repository Visibility Change

AnalysisType: rule
Filename: github_repo_visibility_change.py
RuleID: "Github.Repo.VisibilityChange"
DisplayName: "GitHub Repository Visibility Change"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Exfiltration:Exfiltration Over Web Service
Reports:
  MITRE ATT&CK:
    - TA0010:T1567
Reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility
Severity: High
Description: Detects when an organization repository visibility changes.
Tests:
  - Name: GitHub - Repo Visibility Change
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "repo.access",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }
  - Name: GitHub - Repo disabled
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "repo.disable",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }


# ------ paired body: github_repo_visibility_change.py ------

def rule(event):

    return event.get("action") == "repo.access"


def title(event):
    repo_access_link = f"https://github.com/{event.get('repo','<UNKNOWN_REPO>')}/settings/access"
    return (
        f"Repository [{event.get('repo', '<UNKNOWN_REPO>')}] visibility changed. "
        f"View current visibility here: {repo_access_link}"
    )