LoFP / developers travelling or switching between home, mobile and corporate networks will appear from a new asn the first time each is used. ci runners and cloud build services appear once per cloud provider asn; add exceptions for known automation identities if the volume is high.

FROM logs-github.audit-*
| WHERE event.dataset == "github.audit" AND event.action IN ("git.push", "git.clone")
  AND github.repository_public == false
  AND user.name IS NOT NULL AND github.actor_ip IS NOT NULL
| IP_LOCATION asn = github.actor_ip WITH { "database_file": "GeoLite2-ASN.mmdb", "properties": ["asn", "organization_name"] }
| IP_LOCATION geo = github.actor_ip WITH { "properties": ["country_iso_code"] }
| WHERE asn.asn IS NOT NULL
| STATS Esql.event_count = COUNT(*),
        Esql.first_seen = MIN(@timestamp),
        Esql.last_seen = MAX(@timestamp),
        Esql.ip_count = COUNT_DISTINCT(github.actor_ip),
        Esql.ip_values = VALUES(github.actor_ip),
        Esql.repo_values = VALUES(github.repo),
        Esql.event_action_values = VALUES(event.action),
        Esql.country_values = VALUES(geo.country_iso_code),
        Esql.user_agent_values = VALUES(github.user_agent)
  BY user.name, asn.asn, asn.organization_name
// The 7-day history is the rule look-back (from = now-10085m). A user/ASN pair is new when its first
// event falls inside the current interval; the 10m bound allows for the 5m interval plus scheduling drift.
| WHERE DATE_DIFF("minute", Esql.first_seen, NOW()) <= 10
| EVAL Esql.source_as_number = asn.asn, Esql.source_as_organization_name = asn.organization_name
| KEEP user.name, Esql.*