Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects GitHub API requests from automated scraping tools that may be collecting sensitive repository data.

Strategy

This rule monitors GitHub audit logs for API requests containing common user agents from scraping tools. Automated scraping tools often use distinctive user agent strings and generate high-volume API requests that differ from normal user behavior patterns.

Triage & Response

• Examine the GitHub API requests from {{@github.actor}} to determine the scope and nature of data being accessed.
• Review the repositories, organizations, and resources targeted by the automated tool to assess potential data exposure risks.
• Identify if the scraping activity is authorized by checking with repository owners and organization administrators.
• Rotate the access keys involved in this behavior, if needed.