| Guid |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A unique identifier that is a combination of the GUID of the selected scan and the installation’s unique node ID. |
| FSName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A special unique identifier: the app slug combined with its scope (organization or enterprise slug). |
| AppSlug |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The unique identifier (slug) of the installed GitHub App (e.g., dependabot). |
| AccountLogin |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The organization or user account the app is installed on. |
| TargetType |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The type of account the app is installed on (e.g., Organization, User). |
| RepositorySelection |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Whether the app has access to all repositories or a selected subset (all, selected). |
| OrganizationLogin |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The login of the organization the installation belongs to. |
| AppId |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The numeric identifier of the GitHub App. |
| IsPrivileged |
BOOLEAN |
N/A (toggle) |
Indicates whether the app installation has been identified as privileged based on its granted permissions. |
| IsShadow |
BOOLEAN |
N/A (toggle) |
Indicates whether the app installation is a shadow admin, able to reach Tier 0 indirectly. |
| GHTier |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The privilege tier of the object (0 = Tier 0 / crown jewel, 2 = normal). |
| risk |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The calculated risk score of the app installation. |
| ExposurePoint |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The exposure point score of the app installation. |
