[New Rule] Organization Owner Role Granted to User

[imays11]

Description

This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges and new owner roles should be verified to ensure their legitimacy.

Required Info

Target indexes

logs-github.audit-*

Platforms

GitHub

Optional Info

Query

iam where event.dataset== "github.audit" and event.action== "org.update_member" and github.permission== "admin"

References

Example Data