Detection: Organization Application Installed

Overview

Detect when an application integration was installed in a GitHub organization. Installing an application may introduce new permissions, external service access, or third-party integrations, which can impact security and compliance. Monitoring these installations helps ensure that only trusted applications are granted access.

References:

Using GitHub Applications

Usage

Run the detection in your terminal:

powerpipe detection run github_audit_log_detections.detection.organization_application_installed

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe detection run github_audit_log_detections.detection.organization_application_installed --share

SQL

This detection uses a named query:

select
  tp_timestamp as timestamp,
action as operation,
additional_fields ->> 'integration' as resource,
actor,
tp_source_ip as source_ip,
tp_index as organization,
split_part(repo, '/', 2) as repository,
tp_id as source_id,
*
exclude (actor, timestamp)

from
  github_audit_log
where
  action = 'integration_installation.create'
order by
  tp_timestamp desc;

Detection: Organization Application Installed

Overview

Usage

SQL

Tags