Detection: Repository Member Updated
Overview
Detect when a repository member was added or removed. Changes to the collaborator list may indicate modifications to access permissions, onboarding or offboarding of users, or potential unauthorized access. Monitoring these events helps ensure repository security and adherence to access control policies.
References:
Usage
Run the detection in your terminal:
powerpipe detection run github_audit_log_detections.detection.repository_member_updatedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run github_audit_log_detections.detection.repository_member_updated --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,action as operation,concat('https://github.com/', user) as resource,actor,tp_source_ip as source_ip,tp_index as organization,split_part(repo, '/', 2) as repository,tp_id as source_id,*exclude (actor, timestamp)
from github_audit_logwhere action in ('repo.add_member', 'repo.remove_member')order by tp_timestamp desc;