Audit logs: a foundation for enterprise security

GitHub positions high-quality audit logs as essential for compliance, security investigations, and accountability. Recent updates to its enterprise cloud offering focus on expanding the breadth of logged events and enriching the context around them, giving security teams more granular visibility into developer activity, API usage, and authentication flows.

Streaming API activity to your SIEM

With audit log streaming generally available since January 2022, over 800 enterprises now push near real-time audit and Git events to one of six supported endpoints for storage or Security Information and Event Management (SIEM) systems. The feature provides data exploration, threat detection, compliance monitoring, operational insights, and up to seven days of stream pause without data loss.

A significant expansion adds REST API requests targeting private and internal repositories to the audit log stream, currently in public beta for Enterprise Cloud customers. GraphQL endpoint coverage is planned. This addresses the fact that API usage often introduces security blind spots, as custom integrations and scripts can operate with high-privilege tokens. With this data streamed, owners can:

  • Analyze API usage against private and internal repositories.
  • Diagnose misconfigured applications or integrations.
  • Identify which authentication tokens specific applications are using.
  • Troubleshoot API rate limiting issues.
  • Use API activity in forensic investigations.
  • Build anomaly detection for potentially malicious API behavior.

Enabling this requires configuring audit log streaming to include API requests via the enterprise settings.

Token metadata for credential threat hunting

Given that compromised credentials were the top initial attack vector in 19% of breaches per IBM Security's 2022 Cost of a Data Breach Report, GitHub has added authentication token metadata to audit log events. Administrators can query logs for activity tied to a specific token, tracing usage of potentially compromised credentials. Combined with streamed API requests, this reveals the authentication method used for each API call, whether successful or not, improving the ability to detect and contain malicious activity early.

Gif of audit log

Details on querying token activity are available in GitHub's documentation on identifying audit log events performed by an access token.

Linking activity to corporate identity

For enterprises using Security Assertion Markup Language (SAML) single sign-on and System for Cross-domain Identity Management (SCIM), a private beta now displays external identity data within audit log events. This links UI-based and API-driven actions to the individual corporate identity behind them. Git events with external identity data are expected to follow. This metadata simplifies correlating GitHub activity with logs from identity providers and other systems, providing clearer attribution for investigations.

image of audit logs showing Recent events

Enterprise owners interested in this capability should contact their GitHub account manager or the sales team to enable the private beta.

Exporting security findings to business context

Beyond audit logs, GitHub Advanced Security (GHAS) now integrates with Splunk, Microsoft Sentinel, DataDog, Elastic, Sumo Logic, and Panther. These SIEM integrations allow security operations teams to combine GHAS findings with data from a Configuration Management Database (CMDB), user directories, or asset attribution systems. This enables practical business-informed queries, such as:

  • Severe vulnerabilities in high-profile applications.
  • Security alert counts by business unit.
  • Resolved secrets on a per-team basis.
  • Average time to remediate a vulnerability.
  • Repositories dependent on a vulnerable dependency.

The integrations also let teams join GHAS data with audit log streams, making it possible to check, for instance, whether a leaked API token was used after secret scanning flagged it.

For enterprises aiming to close visibility gaps, these updates advocate for a workflow of enabling new audit log features, streaming data to a preferred endpoint, and leveraging SIEM integrations to place security events within a wider risk context.