| Guid |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A unique identifier that is a combination of the GUID of the selected scan and the user’s unique node ID. |
| FSName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A special unique identifier: the user’s login combined with its scope (organization or enterprise slug). |
| Login |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The unique account handle (username) of the GitHub user (e.g., omersahinler). |
| Name |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The display name of the user. |
| Email |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The email address associated with the user account. |
| OrganizationRole |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The user’s role within the organization (e.g., admin, member). |
| OrganizationLogin |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The login of the organization the user belongs to. |
| IsOutsideCollaborator |
BOOLEAN |
N/A (toggle) |
Indicates whether the user is an outside collaborator rather than a full organization member. |
| TwoFactorAuthentication |
BOOLEAN |
N/A (toggle) |
Indicates whether the user has two-factor authentication (2FA) enabled. |
| IsInactive |
BOOLEAN |
N/A (toggle) |
Indicates whether the account has been inactive beyond the configured inactivity threshold. |
| IsPrivileged |
BOOLEAN |
N/A (toggle) |
Indicates whether the user has been identified as privileged based on their effective permissions. |
| IsShadow |
BOOLEAN |
N/A (toggle) |
Indicates whether the user is a shadow admin, able to reach Tier 0 indirectly without being an obvious administrator. |
| GHTier |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The privilege tier of the object (0 = Tier 0 / crown jewel, 2 = normal). Lower is more privileged. |
| risk |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The calculated risk score of the user. |
| ExposurePoint |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The exposure point score: how reachable or exposed the user is within the graph. |
| PublicRepos |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The number of public repositories owned by the user. |
| Followers |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The number of followers the user has. |
| CreatedAt |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The date the user account was created. |
| LastActivityAt |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The date of the user’s most recent activity. |
