SIEM integrations bring GitHub Advanced Security data into the tools security teams already use
GitHub Advanced Security (GHAS) gives development teams a view into application security findings through the Security Overview page, but security operations teams often need more: custom queries, dashboards that join GitHub data with the rest of their environment, and the ability to correlate alerts with logs from other systems. New integrations with Splunk, Microsoft Sentinel, Datadog, Elastic, Sumo Logic, and Panther let organizations export GHAS data into those external reporting tools.
Once GHAS data lands in a SIEM, teams can combine it with context such as a configuration management database (CMDB), user directory, or asset attribution system. That makes it possible to understand security events in the context of business risk. Practical examples from the GitHub announcement include:
- Severe vulnerabilities in high-profile or user-facing applications
- A count of security alerts per business unit
- Secrets resolved on a per-team basis
- Average time to remediate a vulnerability
- Which repositories depend on a vulnerable dependency
Joining GHAS data with the GitHub Audit Log opens up deeper investigations. For instance, a team could determine whether an API token flagged by secret scanning was actually used after it leaked.
Organizations using a SIEM not on this list can follow GitHub's detailed integration guide to build their own. SIEM and logging vendors interested in the same path can join the technology partner program. Many integrations are open source, and contributions such as queries or additional data sources are accepted via pull request. GitHub also notes that it has partnered with risk-based vulnerability management platforms for a more prescriptive view of GHAS data, with details to follow in a separate announcement.
What each integration offers
Splunk
The Splunk integration, available on GitHub and Splunkbase, ships as several add-on components:
- GitHub Audit Log Collection: Audit logs from GitHub Enterprise Cloud
- GitHub.com Webhooks: A select set of events such as Push, PullRequest, and Repo
- GitHub Enterprise Server Syslog Forwarder: Audit and application logs from GitHub Enterprise Server
- GitHub Enterprise Collectd monitoring: Performance and infrastructure metrics from GitHub Enterprise Server
A configuration video walks through setup.
Microsoft Sentinel
Microsoft's cloud-native SIEM/SOAR platform gets a GitHub integration in public preview through the sentinel4github solution in the Azure Marketplace. The solution includes connectors for GitHub audit logs and GHAS events. The Azure-Sentinel GitHub repository hosts data connectors, log parsers, visualization workbooks, threat analytics detections, and threat hunting queries.
Demos are available for the GitHub App for Sentinel and for configuring Sentinel with GitHub Advanced Security.
Datadog
The Datadog GitHub Apps integration, already used to reduce incident MTTR, now spans Audit Logs, Code Scans, Secret Scans, and Repository Metrics. This lets engineering teams see security vulnerabilities in context and act on them quickly. Enabling the new features is a matter of checking boxes in the integration configuration tile. The integration ships with configurable out-of-the-box dashboards for summarizing key insights to executives. Teams can layer on Datadog's Monitors for alerts and use the Logs Explorer for deeper investigation.
Sumo Logic
Sumo Logic's GitHub app in the Sumo App Catalog ingests data directly from GitHub Webhooks, audit logs, and GHAS events. Included dashboards, searches, and alerts surface repository and commit activity, normal and anomalous user behavior, and security alerts from secret scanning, code scanning, and Dependabot. Customers can correlate that GitHub data with other sources in Sumo Logic for broader context.
Elastic Security
Elastic's GitHub integration, installable from the Elastic UI and viewable in the integration repository, ingests GitHub audit events and GHAS events into Elastic Security. Visualizations, dashboards, and predefined searches ship with the integration. Full details are in the Elastic documentation, and a video demonstrates ingesting GHAS alerts.
Panther
Panther's GitHub integration focuses on audit logging for security tracking. It ingests activities such as user logins, data access, and security configuration changes into Panther's security data lake, where they can be searched, correlated, and investigated at petabyte scale using Panther's Detection-as-Code approach.
