> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/github-entities/aws-iam-user.md).

# GitHub User

### GitHub User Fields

<table><thead><tr><th>Field</th><th>Type</th><th width="170">Possible Operators</th><th>Description</th></tr></thead><tbody><tr><td>Guid</td><td>TEXT</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>A unique identifier that is a combination of the GUID of the selected scan and the user's unique node ID.</td></tr><tr><td>FSName</td><td>TEXT</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>A special unique identifier — the user's login combined with its scope (organization or enterprise slug).</td></tr><tr><td>Login</td><td>TEXT</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>The unique account handle (username) of the GitHub user (e.g., omersahinler).</td></tr><tr><td>Name</td><td>TEXT</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>The display name of the user.</td></tr><tr><td>Email</td><td>TEXT</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>The email address associated with the user account.</td></tr><tr><td>OrganizationRole</td><td>TEXT</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>The user's role within the organization (e.g., admin, member).</td></tr><tr><td>OrganizationLogin</td><td>TEXT</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>The login of the organization the user belongs to.</td></tr><tr><td>IsOutsideCollaborator</td><td>BOOLEAN</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>Indicates whether the user is an outside collaborator rather than a full organization member.</td></tr><tr><td>TwoFactorAuthentication</td><td>BOOLEAN</td><td>LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY</td><td>Indicates whether the user has two-factor authentication (2FA) enabled.</td></tr><tr><td>IsInactive</td><td>BOOLEAN</td><td>N/A</td><td>Indicates whether the account has been inactive beyond the configured inactivity threshold.</td></tr><tr><td>IsPrivileged</td><td>BOOLEAN</td><td>N/A</td><td>Indicates whether the user has been identified as privileged based on their effective permissions.</td></tr><tr><td>IsShadow</td><td>BOOLEAN</td><td>N/A</td><td>Indicates whether the user is a shadow admin — able to reach Tier 0 indirectly without being an obvious administrator.</td></tr><tr><td>GHTier</td><td>NUMBER</td><td>EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL</td><td>The privilege tier of the object (0 = Tier 0 / crown jewel, 2 = normal). Lower is more privileged.</td></tr><tr><td>risk</td><td>NUMBER</td><td>EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL</td><td>The calculated risk score of the user.</td></tr><tr><td>ExposurePoint</td><td>NUMBER</td><td>EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL</td><td>The exposure point score — how reachable or exposed the user is within the graph.</td></tr><tr><td>PublicRepos</td><td>NUMBER</td><td>EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL</td><td>The number of public repositories owned by the user.</td></tr><tr><td>Followers</td><td>NUMBER</td><td>EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL</td><td>The number of followers the user has.</td></tr><tr><td>CreatedAt</td><td>DATE</td><td>SMALLER, LARGER, BETWEEN, EQUAL</td><td>The date the user account was created.</td></tr><tr><td>LastActivityAt</td><td>DATE</td><td>SMALLER, LARGER, BETWEEN, EQUAL</td><td>The date of the user's most recent activity.</td></tr></tbody></table>