> For the complete documentation index, see [llms.txt](https://docs.scanner.dev/scanner/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/github.md).

# Github

Github audit logs provide visibility into your codebase's security and administrative activities across repositories. These logs capture critical events about your Github repositories including authentication changes, access control modifications, and policy updates. They also track aspects of your codebase such as code scanning alerts, secret scanning detections, and Dependabot activity. These logs are useful for maintaining compliance, investigating security incidents, detecting unauthorized access, and understanding administrative changes across your GitHub enterprise.

This guide walks through how to set up Github audit logs in Scanner Collect, using Github log streaming to send logs directly to Scanner’s HEC (HTTP Event Collector) receiver.

## Create a Collect Rule

{% stepper %}
{% step %}

### Create a New Source

In the Scanner UI, go to the Collect tab.

* From the Overview page click the '+' icon in the upper right corner
* Select create new **Collect Rule**
* Click **Select a Source Type**.
* Choose **Github**.
  {% endstep %}

{% step %}

### Configure the Source

* Set a Display Name such as `my-org-github-logs`.
  {% endstep %}

{% step %}

### Configure Destination

* Select the S3 bucket where you want raw logs delivered.
* (Optional) Enter a bucket prefix. The default is fine for most setups.
  {% endstep %}

{% step %}

### Review and Create

* Review your configuration.

After creation, Scanner will display a unique token and a HEC domain. Keep these handy, as they will be needed in the next step.
{% endstep %}

{% step %}

### Configure in Github

* Log in to `github.com` with an account with permissions to manage your enterprise.
* Navigate to the settings page for your enterprise:
  * Click your profile photo.
  * Click **Settings**.
  * Click **Switch settings context** (which is underneath your account name), then select your enterprise.
* Click **Audit log** on the left.
* Click **Log streaming**.
* Click **Configure stream** -> **Splunk**.
* Set the **Domain** field to the HEC domain from the previous step.
* Set the **Port** field to `443`.
* Set the **Token** field to the token from the previous step.
* Ensure "Enable SSL verification" is checked.
* Click **Check endpoint**.
* Click **Save**.
  {% endstep %}
  {% endstepper %}

## Create an Index Rule

Create an Index Rule to have Scanner index those logs for fast search and detections.

{% content-ref url="/pages/Gem9jwD4aqayN3OiChpN" %}
[Create an Index Rule](/scanner/using-scanner-complete-feature-reference/data-ingestion/create-an-index-rule.md)
{% endcontent-ref %}

### Github Defaults

When you create the Index Rule from the Collect Rule, the following defaults are pre-populated:

* **Transformations**: Add Metadata, Parse JSON Columns, ECS Normalization: Github
* **Timestamp Field**: `.@timestamp` (falls back to `.@scnr.collect.metadata.hec.time`)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/github.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.