Large Number of Git Repos Accessed in Rapid Succession

Trevor James@tjames

•updated Jul 16, 2025•2•0•30

This rule is designed to identify any non-bot user accessing an unusually high number of repositories in a short time window (30 mins), which may indicate credential abuse or insider threat activity.