code: def github_site_admin_action(rec):
      """
      author:       @mimeframe
      description:  A Github site admin tool/action was used.
                    Example: 'staff.fake_login'
                     "A site admin signed into GitHub Enterprise as another user.""
      reference:    https://help.github.com/enterprise/2.11/admin/articles/audited-actions/
      """
      return rec["action"].startswith("staff.")
  
label_desc: Use image node_id 1 for calling a global function with example usage: github_site_admin_action(rec) and returns: rec