turbot/tailpipe-mod-github-audit-log-detections

Query: Top 10 Source IPs

Description

List the top 10 source IPs by frequency, excluding internal GitHub IPs.

Usage

powerpipe query github_audit_log_detections.query.activity_dashboard_events_by_source_ip

Tailpipe Tables

SQL

select
tp_source_ip as "Source IP",
count(*) as "Events"
from
github_audit_log
where
tp_source_ip is not null
and tp_source_ip not like '%github.com'
group by
tp_source_ip
order by
count(*) desc
limit 10;

Dashboards

The query is used in the dashboards: