list_detections
List Harden-Runner security detections for a GitHub organization, filtered by detection type (e.g., 'Action-Uses-Imposter-Commit') and status (new, suppressed, resolved).
Instructions
List Harden-Runner detections for an organization, filtered by detection type and status. Common detection IDs: 'Action-Uses-Imposter-Commit', 'Suspicious-Process-Events' (aggregates Runner-Worker-Memory-Read + Reverse-Shell + Privileged-Container), 'Anomalous-Outbound-Network-Call', 'Source-Code-Overwritten', 'Secret-In-Build-Log', 'Harden-Runner-Config-Changed', 'NPM-Package-Upgrade-To-Suspicious-Version', 'Agent-Tampered'.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | GitHub organization | |
| detectionId | Yes | Detection type (see description for common values) — required by the API | |
| status | No | Detection status filter. Defaults to 'new'. | |
| tenantWide | No | Query customer/tenant scope instead of owner scope (default: owner) |