GitHub Invitation Sent To Non-Company Email Domain

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•2•0•39

This rule detects when an invitation to join a GitHub enterprise or organization is sent to an email address that does not belong to a company-managed domain. It specifically looks for 'business.invite_admin', 'business.invite_billing_manager', or 'org.invite_member' events where the invitee's email address does not match the configured company domain regex.