GitHub Repository Downloaded in Bulk
Detects repositories being downloaded. Source code is intellectual property and frequently contains embedded secrets, infrastructure detail and the logic of the security controls themselves. Bulk download by one actor is the clearest signal of code theft, whether by a departing engineer or a compromised account. Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870). Integration guide: https://bloo.io/docs/hypercloud/github-connector BQL (Bloo Query Language): stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED' | duration 1h | groupby target | select target, distinct_count(repositoryid) | having distinct_count_col1 > 5
Sigma
