> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub NHI Threat Hunter Agent

## Overview

The GitHub NHI Threat Hunter examines the non-human identities inside your GitHub organization and surfaces the combinations of factors that create real, exploitable risk. It is one of the Identity Agent Force agents. For the big picture and how agents work, see the [Identity Agent Force Overview](/kb/identity-intelligence/identity-intelligence-overview).

## What it analyzes

The agent reads the integrations, credentials, and automation surfaces that accumulate in a GitHub organization over time and never enter a traditional access review.

| Data domain | What it extracts |
| - | - |
| Application identities | GitHub Apps installed in the organization, including their granted permissions and installation scope, plus OAuth apps with access to the organization and the tokens they hold |
| Credentials and keys | Organization-level personal access tokens (classic and fine-grained) with their scopes and expiry, deploy keys configured on repositories, and SSH and GPG keys attached to accounts |
| Identities and membership | Organization members and their org-level roles, outside collaborators, machine users used for automation, and SAML identities mapped to GitHub accounts where SAML SSO is configured |
| Automation and CI/CD | Self-hosted runners at the organization and repository level, GitHub Actions configuration, Actions secrets (inventory and last-updated metadata only, values are never read), and environments with their protection rules |
| Configuration | Repository and organization administration settings, and webhooks including their endpoint targets and whether a webhook secret is set |

If you provide an Enterprise Slug on the integration, the analysis is scoped to that GitHub Enterprise account rather than a single organization.

## What you will find

The GitHub profile targets Critical and High severity only, to keep the signal high and avoid alert fatigue. Each finding carries a severity rating, the specific evidence behind it, and a remediation workflow. Typical findings include:

* Personal access tokens that are over-scoped, never expire, or have not been used in a long time
* Deploy keys that grant write access, are orphaned, or should not exist on the repository
* GitHub Apps installed with admin-level scopes whose owners have left the organization
* OAuth tokens still issued to third-party apps that are no longer in active use
* Machine users with privileged scopes and no clear owner
* Webhooks with no secret configured, or pointed at unexpected endpoints
* Self-hosted runners that are unowned or attached at an unexpectedly broad scope
* Compound-risk patterns: for example, a long-lived organization-admin token held by a machine user with no matching SAML identity

## Connect and get started

1. Connect GitHub using the GitHub (Graph) / NHI connector, which is separate from the standard GitHub connector used for accounts and entitlements. See [Connecting GitHub (Graph) / NHI Connector](/integrations/library/non-human/github-nhi) for the required read-only permissions and setup steps.
2. Create an agent with the **GitHub NHI Threat Hunter** specialization (see the Identity Agent Force Overview for the create flow).
3. Open the **Identity Agent Force** page, review each Issue, and launch its remediation workflow.

The agent produces its first findings on the initial sync. It works with whatever permissions it is granted: a permission you choose not to grant means no findings in that area, rather than a failed run. Because this integration does not sync accounts or entitlements, an error state on the integration tile is not an indication that anything is wrong.

**This agent is in beta.** Access is by invitation. Contact your Lumos account team or your CSM to request access.

## Read-only analysis

The analysis is read-only. Every permission the integration requests is read-only, and Lumos never creates, modifies, or deletes anything in your GitHub organization.

Questions? Contact your Lumos account team or open a support ticket.