GitHub Application Installed

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•3•0•41

This rule detects when a GitHub application is installed within an organization. The detection is based on the `integration_installation.create` event in GitHub audit logs. An untrusted application, if installed, could be granted permissions to access sensitive data within the GitHub organization, posing a security risk.