✄𐘗
text code block:
✄𐘗FROM logs-github.audit-*
| WHERE event.dataset == "github.audit" AND event.category == "configuration"
  AND event.action IN ("repo.register_self_hosted_runner", "org.register_self_hosted_runner", "enterprise.register_self_hosted_runner")
  AND user.name IS NOT NULL AND github.actor_ip IS NOT NULL
| IP_LOCATION asn = github.actor_ip WITH { "database_file": "GeoLite2-ASN.mmdb", "properties": ["asn", "organization_name"] }
| IP_LOCATION geo = github.actor_ip WITH { "properties": ["country_iso_code"] }
| WHERE asn.asn IS NOT NULL
| STATS Esql.event_count = COUNT(*),
        Esql.first_seen = MIN(@timestamp),
        Esql.last_seen = MAX(@timestamp),
        Esql.ip_values = VALUES(github.actor_ip),
        Esql.event_action_values = VALUES(event.action),
        Esql.repo_values = VALUES(github.repo),
        Esql.org_values = VALUES(github.org),
        Esql.country_values = VALUES(geo.country_iso_code),
        Esql.user_agent_values = VALUES(github.user_agent)
  BY user.name, asn.asn, asn.organization_name
// The 5-day history is the rule look-back (from = now-7205m). A user/ASN pair is new when its first
// event falls inside the current interval; the 10m bound allows for the 5m interval plus scheduling drift.
| WHERE DATE_DIFF("minute", Esql.first_seen, NOW()) <= 10
| EVAL Esql.source_as_number = asn.asn, Esql.source_as_organization_name = asn.organization_name
| KEEP user.name, Esql.*