Skip to main content

​
Overview

The GitHub NHI Threat Hunter examines the non-human identities inside your GitHub organization and surfaces the combinations of factors that create real, exploitable risk. It is one of the Identity Agent Force agents. For the big picture and how agents work, see the Identity Agent Force Overview.

​
What it analyzes

The agent reads the integrations, credentials, and automation surfaces that accumulate in a GitHub organization over time and never enter a traditional access review. If you provide an Enterprise Slug on the integration, the analysis is scoped to that GitHub Enterprise account rather than a single organization.

​
What you will find

The GitHub profile targets Critical and High severity only, to keep the signal high and avoid alert fatigue. Each finding carries a severity rating, the specific evidence behind it, and a remediation workflow. Typical findings include:
  • Personal access tokens that are over-scoped, never expire, or have not been used in a long time
  • Deploy keys that grant write access, are orphaned, or should not exist on the repository
  • GitHub Apps installed with admin-level scopes whose owners have left the organization
  • OAuth tokens still issued to third-party apps that are no longer in active use
  • Machine users with privileged scopes and no clear owner
  • Webhooks with no secret configured, or pointed at unexpected endpoints
  • Self-hosted runners that are unowned or attached at an unexpectedly broad scope
  • Compound-risk patterns: for example, a long-lived organization-admin token held by a machine user with no matching SAML identity

​
Connect and get started

  1. Connect GitHub using the GitHub (Graph) / NHI connector, which is separate from the standard GitHub connector used for accounts and entitlements. See Connecting GitHub (Graph) / NHI Connector for the required read-only permissions and setup steps.
  2. Create an agent with the GitHub NHI Threat Hunter specialization (see the Identity Agent Force Overview for the create flow).
  3. Open the Identity Agent Force page, review each Issue, and launch its remediation workflow.
The agent produces its first findings on the initial sync. It works with whatever permissions it is granted: a permission you choose not to grant means no findings in that area, rather than a failed run. Because this integration does not sync accounts or entitlements, an error state on the integration tile is not an indication that anything is wrong. This agent is in beta. Access is by invitation. Contact your Lumos account team or your CSM to request access.

​
Read-only analysis

The analysis is read-only. Every permission the integration requests is read-only, and Lumos never creates, modifies, or deletes anything in your GitHub organization. Questions? Contact your Lumos account team or open a support ticket.