Github Audit Logs

GitHub Audit Logs provide a detailed record of actions and events within a GitHub organization or repository. These logs capture information such as user logins, repository changes (e.g., pushes, merges, deletions), permission modifications, and security settings updates. They help administrators track user activity, ensure security compliance, and audit changes for troubleshooting and incident investigation.

Ingest Methods

Github audit logs can be ingested using two separate methods, streaming audit logs where Github will push your logs to a cloud storage account to be ingested by RunReveal, and API polling where RunReveal will use an access token to poll your Github organization for new audit logs every 60 seconds.

Log Streaming

Resource Setup

If you plan to use audit log streaming you will need to setup the necessary resources and permissions for RunReveal to get access.

• AWS S3 Bucket
• AWS S3 Bucket with Custom SQS
• Azure Blob Storage
• Google Cloud Storage

arn:aws:sns:<REGION>:253602268883:runreveal_github

Github Setup

Once the resources and permissions are set for RunReveal you will need to setup Github to send logs to your bucket.

Follow the steps provided in the GitHub documentation to setup streaming for the cloud provider that you are using.

API Polling

When setting up API polling RunReveal needs the name of the organization to poll, an API token, and which event types to include.

API Token

To generate an API token navigate to the Personal access tokens (classic) page in your GitHub account and click on Generate new token, or follow this link https://github.com/settings/tokens/new

Give the token a description and select an expiration for it. When selecting the scopes the only required scope is the read:audit_log.

Event Types

The Event Types setting controls which audit log events RunReveal polls from GitHub:

• All events - Collects both web and Git events.
• Web events only (default) - Actions performed through the GitHub web UI, REST API, or GraphQL API (e.g., repository settings changes, permission updates, workflow runs).
• Git events only - Transport-layer Git operations such as git.clone, git.fetch, and git.push.

Enable actor IP addresses (before RunReveal setup)

GitHub does not include actor IP addresses in audit logs unless you turn on source IP disclosure at the organization level. If this setting is off, RunReveal will ingest events without actor_ip (mapped to srcIP in github_logs), which limits geo and IP-based detections.

Enable this in GitHub before you connect RunReveal. The setting only affects new audit events after you save—it does not backfill IPs on historical logs.

1. In GitHub, open your organization (not a repository).
2. Go to Settings → Audit log → the Settings tab.
3. Under Disclose actor IP addresses in audit logs, check Enable source IP disclosure.
4. Click Save.

Review GitHub’s documentation on displaying IP addresses in the audit log for enterprise-wide behavior and legal/privacy considerations before enabling.

Setup

Once GitHub-side setup is complete (including IP disclosure, if you need IP fields), log into RunReveal and create the Github source.

Select the ingest method that you are using and fill in the details for your setup.

Verify It's Working

Once added the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'github' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.