Detects a burst of failed GitHub API requests (HTTP 4xx/5xx) recorded as `api.request`, where a single non-bot actor and source IP generate a high volume of failures spread across many distinct API routes within a short window. An adversary probing private repositories, secrets, or admin routes produces clusters of 401/403/404 responses across many endpoints, whereas broken automation usually hammers a small number of routes. Grouping by actor and source IP and requiring both a high failure count and a high number of distinct routes separates broad enumeration from a single misconfigured integration. Requires API Request Events on GitHub audit log streaming.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.