Detects bursts of failed GitHub API requests (HTTP 4xx/5xx) recorded as api.request in GitHub audit logs. The rule focuses on a single non-bot actor and a single source IP generating failures across many distinct API routes within a short window. It requires API Request Events via GitHub audit log streaming and the Elastic GitHub integration. The detection groups by user.name and github.actor_ip and triggers when the actor/IP accumulate at least 15 failures spread across 10 or more distinct routes within the window, distinguishing broad enumeration from a single misconfigured integration. Relevant Esql fields exposed for investigation include the number of events, distinct routes, repositories probed, route values, status codes, organizations, programmatic access type, user agent, and token IDs. The rule is mapped to MITRE ATT&CK Discovery (T1526 Cloud Service Discovery) and TA0007 (Discovery). It provides triage guidance to review tokens, routes probed, and whether later requests yield success, along with remediation steps such as revoking tokens or blocking IPs if activity is reconnaissance.