GitHub Organization Repository Enumeration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects potential GitHub organization repository enumeration by monitoring HTTP traffic to api.github.com with URIs containing '/orgs/'. A threshold of 20 requests within 60 seconds from a single source IP address is used to trigger an alert, indicating a possible network scan or reconnaissance activity targeting GitHub organizations.