> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/github-entities/github-user.md).

# GitHub User

### GitHub User Fields

| Field                   | Type    | Possible Operators                                             | Description                                                                                                           |
| ----------------------- | ------- | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| Guid                    | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of the GUID of the selected scan and the user's unique node ID.             |
| FSName                  | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier: the user's login combined with its scope (organization or enterprise slug).              |
| Login                   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The unique account handle (username) of the GitHub user (e.g., omersahinler).                                         |
| Name                    | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The display name of the user.                                                                                         |
| Email                   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The email address associated with the user account.                                                                   |
| OrganizationRole        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The user's role within the organization (e.g., admin, member).                                                        |
| OrganizationLogin       | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The login of the organization the user belongs to.                                                                    |
| IsOutsideCollaborator   | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user is an outside collaborator rather than a full organization member.                         |
| TwoFactorAuthentication | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user has two-factor authentication (2FA) enabled.                                               |
| IsInactive              | BOOLEAN | N/A (toggle)                                                   | Indicates whether the account has been inactive beyond the configured inactivity threshold.                           |
| IsPrivileged            | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user has been identified as privileged based on their effective permissions.                    |
| IsShadow                | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user is a shadow admin, able to reach Tier 0 indirectly without being an obvious administrator. |
| GHTier                  | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The privilege tier of the object (0 = Tier 0 / crown jewel, 2 = normal). Lower is more privileged.                    |
| risk                    | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The calculated risk score of the user.                                                                                |
| ExposurePoint           | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The exposure point score: how reachable or exposed the user is within the graph.                                      |
| PublicRepos             | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The number of public repositories owned by the user.                                                                  |
| Followers               | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The number of followers the user has.                                                                                 |
| CreatedAt               | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date the user account was created.                                                                                |
| LastActivityAt          | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date of the user's most recent activity.                                                                          |