Skip to main content
All GitHub integration capabilities

​
About

Stream your GitHub enterprise’s audit log into Sazabi: repository visibility and permission changes, personal access token and deploy key activity, Actions secret changes, membership changes, and Git events for every organization in the enterprise. GitHub pushes events as they happen to Sazabi, which accepts GitHub’s Splunk HTTP Event Collector format.

​
Prerequisites

  • A GitHub Enterprise Cloud enterprise. Audit log streaming is an enterprise feature.
  • An enterprise owner account, which is the role that can configure streaming.
  • Your Sazabi intake URL (shown above). GitHub asks for its hostname as the Domain.

​
Which plan unlocks which events

Actions secrets are audited when they are created, updated, or removed. GitHub does not audit secret reads.

​
Set up in the dashboard

1

​
Open log streaming

In GitHub, open your enterprise, then go to Settings > Audit log > Log streaming. Choose Configure stream > Splunk.
2

​
Fill in the Splunk form

  • Domain: the hostname of your Sazabi intake URL (shown above), without https:// or a path
  • Port: 443
  • Token: your Sazabi public key (shown above)
  • Enable SSL verification: on
GitHub sends events to /services/collector on that domain, which is the path in your intake URL.
3

​
Check and save

Click Check endpoint, then Save. GitHub starts streaming the audit log to Sazabi.
4

​
Optional: add API request events

Under Settings > Audit log > Settings, turn on Enable API Request Events to also stream REST API calls.

​
Set up with the CLI

You can also register the source with the Sazabi CLI:
The command prints the intake URL and public key. Use the URL’s hostname as GitHub’s Domain and the public key as the Token.

​
Verify

Change a repository setting, clone a repository, or create a personal access token. Open the Intake page and confirm logs from the GitHub Audit Log source appear.

​
What you get

Each event keeps GitHub’s full JSON as the log body. Common fields are also stored as attributes: github.audit.action, github.audit.actor, github.audit.org, github.audit.repo, github.audit.visibility, github.audit.programmatic_access_type, github.audit.hashed_token, and github.audit.deploy_key_fingerprint. The log time is GitHub’s @timestamp.

​
Troubleshooting

Check endpoint fails — Confirm the Domain is only the hostname of your intake URL, with no scheme or path, and that the port is 443. Stream paused — GitHub keeps up to seven days of events while a stream is paused and sends them when it resumes.

​
Further reading

Streaming the audit log

GitHub’s guide to enterprise audit log streaming.

Log sources

Browse the full log source catalog.