> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/github-entities/aws-iam-access-key.md).

# GitHub App Installation

### GitHub App Installation Fields

| Field               | Type    | Possible Operators                                             | Description                                                                                                       |
| ------------------- | ------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Guid                | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of the GUID of the selected scan and the installation's unique node ID. |
| FSName              | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier — the app slug combined with its scope (organization or enterprise slug).             |
| AppSlug             | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The unique identifier (slug) of the installed GitHub App (e.g., dependabot).                                      |
| AccountLogin        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The organization or user account the app is installed on.                                                         |
| TargetType          | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The type of account the app is installed on (e.g., Organization, User).                                           |
| RepositorySelection | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Whether the app has access to all repositories or a selected subset (all, selected).                              |
| OrganizationLogin   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The login of the organization the installation belongs to.                                                        |
| AppId               | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The numeric identifier of the GitHub App.                                                                         |
| IsPrivileged        | BOOLEAN | N/A                                                            | Indicates whether the app installation has been identified as privileged based on its granted permissions.        |
| IsShadow            | BOOLEAN | N/A                                                            | Indicates whether the app installation is a shadow admin — able to reach Tier 0 indirectly.                       |
| GHTier              | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The privilege tier of the object (0 = Tier 0 / crown jewel, 2 = normal).                                          |
| risk                | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The calculated risk score of the app installation.                                                                |
| ExposurePoint       | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The exposure point score of the app installation.                                                                 |