Github Webhook Events
GitHub Webhook events are automated notifications sent to a specified endpoint when certain actions occur in a repository or organization. These events capture activities such as push events, pull request creations or updates, issue comments, and release publications.
Looking for a different GitHub source? See Github Audit Logs for organization/repository audit trail events, or Rulesets Insights for branch protection rule evaluations.
Setup
This source uses am HTTP webhook to ingest events. Create the Github Webhook source in RunReveal and a new webhook URL will be generated. Use this URL when setting up your source.

In Github under your organization settings, click on the Webhooks menu item and then Add webhook.
Paste the webhook URL that RunReveal provided when setting up your source, set the content type to application/json, and select which events you would like to receive from Github.

Once added Github will begin to forward events to your RunReveal account.
Verify It's Working
Once added the source logs should begin flowing within a minute.
You can validate we are receiving your logs by running the following SQL query.
Schema
The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.
Table: runreveal_logs (22 columns)
runreveal_logs (22 columns)| Column | Type |
|---|---|
id | String |
receivedAt | DateTime |
workspaceID | String |
sourceType | String |
sourceID | String |
eventID | String |
eventName | String |
eventTime | DateTime |
readOnly | Bool |
srcIP | String |
resources | Array(String) |
serviceName | String |
srcASOrganization | Nullable(String) |
srcASNumber | Nullable(UInt32) |
srcASCountryCode | Nullable(String) |
dstIP | String |
dstASOrganization | Nullable(String) |
dstASNumber | Nullable(UInt32) |
dstASCountryCode | Nullable(String) |
actor | Map(String, String) |
tags | Map(String, String) |
rawLog | String |