Github Audit Logs

GitHub Audit Logs provide a detailed record of actions and events within a GitHub organization or repository. These logs capture information such as user logins, repository changes (e.g., pushes, merges, deletions), permission modifications, and security settings updates. They help administrators track user activity, ensure security compliance, and audit changes for troubleshooting and incident investigation.

Ingest Methods

Github audit logs can be ingested using two separate methods, streaming audit logs where Github will push your logs to a cloud storage account to be ingested by RunReveal, and API polling where RunReveal will use an access token to poll your Github organization for new audit logs every 60 seconds.

Log Streaming

Resource Setup

If you plan to use audit log streaming you will need to setup the necessary resources and permissions for RunReveal to get access.

• AWS S3 Bucket
• AWS S3 Bucket with Custom SQS
• Azure Blob Storage
• Google Cloud Storage

arn:aws:sns:<REGION>:253602268883:runreveal_github

Github Setup

Once the resources and permissions are set for RunReveal you will need to setup Github to send logs to your bucket.

Follow the steps provided in the GitHub documentation to setup streaming for the cloud provider that you are using.

API Polling

When setting up API polling RunReveal will only need two items, the name of the organization that we should be polling audit logs for, and an API token to access your account.

API Token

To generate an API token navigate to the Personal access tokens (classic) page in your GitHub account and click on Generate new token, or follow this link https://github.com/settings/tokens/new

Give the token a description and select an expiration for it. When selecting the scopes the only required scope is the read:audit_log.

RunReveal Source Setup

Once all of the other setup steps have been completed you can now log into RunReveal and create the Github source.

Select the ingest method that you are using and fill in the details for your setup.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.