Github audit log SIEM integration
G
Gurjan Lally
Inspecting Github audit logs comes with many benefits; from a cursory look at audit logging docs useful audit events include:
- code security disable / enable events: repository_code_security.disable
- security configuration deleted / updated etc: security_configuration.[deleted|update]
- vulnerability alert rule modificatioon: vulnerability_alert_rule.[delete|disable|enable|create]
- Vulnerable dependency alerts: repository_vulnerability_alert.[create|dismissed|resolve]
- Secret scanning alerts: secret_scanning_alert.[create|leak|resolve]
There are many other useful audit events available: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization#secret_scanning_alert