GitHub OAuth Credential or Token Activity

Siddhant Mishra@Siddhant

•updated yesterday•0•0•2

Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor controls and persist until revoked, making them the standard persistence mechanism on the platform. A token created on a compromised account continues to work long after the password is reset. Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870). Integration guide: https://bloo.io/docs/hypercloud/github-connector BQL (Bloo Query Language): stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED' | groupby target, role, accesstype, operationtype, authtokenhash