HomeAlertsCASE-5390
Back to Alerts

Devon Sato cloned 18 private repositories in a 40-minute window

HighIn reviewAn analyst is actively investigating this alert.User: d.sato@acme-corp.comDetected: 6 hr ago
AI isn't confident enough to auto-remediate this alert — confidence is below 85%.
True positiveCorrelated across 4 security events

d.sato@acme-corp.com cloned 18 private repositories from github.com/acme-corp/* in a 40-minute window between 04:15 and 04:52 — 12× his weekly baseline of 1–2 clones. The cloned set includes unreleased-ml-pipeline (340 MB · 1,204 files · Source Code and IP), payments-core, and auth-gateway. No commits, PRs, or issues were created — the activity pattern is consistent with bulk download before departure. Alex Chen is investigating. 78% confidence: Devon could be setting up a new dev machine, but the 04:15 timing on a Sunday and the selection of 3 unreleased products raises the risk score.

WHY FLAGGED
18 repos cloned in 40 min vs. 1–2 per week baseline — 12× volume, Sunday 04:15
Cloned set includes unreleased-ml-pipeline, payments-core, auth-gateway — 3 unreleased products
Zero commits, PRs, or issues created after cloning — pure download pattern
AI RecommendationsHigh-confidence containment path generated based on verified incident patterns.
Suspend repo access + notify engineering lead
Alert Info
Assigned to
Alex Chen
Alert ID
CASE-5390
AI Investigation
Correlated across 4 security events
Alerts
4 linked
Detection
Datastore types
GitHub, Confluence
Policy
Risk type
Data Dispersion
User
User
Devon Satod.sato@acme-corp.com
Employee ID
ACME009981
Department
Engineering
Employment
Active
Ask Matters AI
Hi, I'm Matters AI. Ask me about your alerts, cases, or policies.