Github

Github audit logs provide visibility into your codebase's security and administrative activities across repositories. These logs capture critical events about your Github repositories including authentication changes, access control modifications, and policy updates. They also track aspects of your codebase such as code scanning alerts, secret scanning detections, and Dependabot activity. These logs are useful for maintaining compliance, investigating security incidents, detecting unauthorized access, and understanding administrative changes across your GitHub enterprise.

This guide walks through how to set up Github audit logs in Scanner Collect, using Github log streaming to send logs directly to Scanner’s HEC (HTTP Event Collector) receiver.

Create a Collect Rule

1

Create a New Source

In the Scanner UI, go to the Collect tab.

• From the Overview page click the '+' icon in the upper right corner
• Select create new Collect Rule
• Click Select a Source Type.
• Choose Github.

2

Configure the Source

• Set a Display Name such as my-org-github-logs.

3

Configure Destination

• Select the S3 bucket where you want raw logs delivered.
• (Optional) Enter a bucket prefix. The default is fine for most setups.

4

Review and Create

• Review your configuration.

After creation, Scanner will display a unique token and a HEC domain. Keep these handy, as they will be needed in the next step.

5

Configure in Github

• Log in to github.com with an account with permissions to manage your enterprise.
• Navigate to the settings page for your enterprise:

  • Click your profile photo.
  • Click Settings.
  • Click Switch settings context (which is underneath your account name), then select your enterprise.
• Click Audit log on the left.
• Click Log streaming.
• Click Configure stream -> Splunk.
• Set the Domain field to the HEC domain from the previous step.
• Set the Port field to 443.
• Set the Token field to the token from the previous step.
• Ensure "Enable SSL verification" is checked.
• Click Check endpoint.
• Click Save.

Create an Index Rule

Create an Index Rule to have Scanner index those logs for fast search and detections.

Create an Index Rule

Github Defaults

When you create the Index Rule from the Collect Rule, the following defaults are pre-populated:

• Transformations: Add Metadata, Parse JSON Columns, ECS Normalization: Github
• Timestamp Field: .@timestamp (falls back to [e-mail])