Detection: Organization User Removed
Overview
Detect when a user was removed from a GitHub organization. Removing a user may indicate a legitimate access revocation or an unauthorized removal. Monitoring these events helps ensure that access controls are properly enforced and align with security policies.
References:
Usage
Run the detection in your terminal:
powerpipe detection run github_audit_log_detections.detection.organization_user_removedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run github_audit_log_detections.detection.organization_user_removed --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,action as operation,concat('https://github.com/', user) as resource,actor,tp_source_ip as source_ip,tp_index as organization,split_part(repo, '/', 2) as repository,tp_id as source_id,*exclude (actor, timestamp)
from github_audit_logwhere action = 'org.remove_member'order by tp_timestamp desc;