> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Audit Log

> Stream your GitHub Enterprise Cloud audit log, including Git events, to Sazabi through GitHub's Splunk audit log streaming target.

[All GitHub integration capabilities](https://docs.sazabi.com/catalogs/integrations/github.md)

## About

Stream your GitHub enterprise's audit log into Sazabi: repository visibility and permission changes, personal access token and deploy key activity, Actions secret changes, membership changes, and Git events for every organization in the enterprise. GitHub pushes events as they happen to Sazabi, which accepts GitHub's Splunk HTTP Event Collector format.

## Prerequisites

* A **GitHub Enterprise Cloud** enterprise. Audit log streaming is an enterprise feature.
* An **enterprise owner** account, which is the role that can configure streaming.
* Your Sazabi intake URL (shown above). GitHub asks for its hostname as the **Domain**.

### Which plan unlocks which events

| GitHub plan | Audit events | Git events | API request events | Streams to Sazabi |
| - | - | - | - | - |
| Enterprise Cloud | Yes | Yes | Yes, after you turn them on | Yes |
| Team | In the GitHub UI and exports only | No | No | No |
| Free / Pro | In the GitHub UI only | No | No | No |

Actions secrets are audited when they are created, updated, or removed. GitHub does not audit secret reads.

## Set up in the dashboard

**Step 1**

### Open log streaming

In GitHub, open your enterprise, then go to **Settings > Audit log > Log streaming**. Choose **Configure stream > Splunk**.

**Step 2**

### Fill in the Splunk form

* **Domain**: the hostname of your Sazabi intake URL (shown above), without `https://` or a path
* **Port**: `443`
* **Token**: your Sazabi public key (shown above)
* **Enable SSL verification**: on

GitHub sends events to `/services/collector` on that domain, which is the path in your intake URL.

**Step 3**

### Check and save

Click **Check endpoint**, then **Save**. GitHub starts streaming the audit log to Sazabi.

**Step 4**

### Optional: add API request events

Under **Settings > Audit log > Settings**, turn on **Enable API Request Events** to also stream REST API calls.

## Set up with the CLI

You can also register the source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md):

```bash theme={"system"}
sazabi log-sources create github_audit_log --mode manual
```

The command prints the intake URL and public key. Use the URL's hostname as GitHub's **Domain** and the public key as the **Token**.

## Verify

Change a repository setting, clone a repository, or create a personal access token. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) and confirm logs from the **GitHub Audit Log** source appear.

### What you get

Each event keeps GitHub's full JSON as the log body. Common fields are also stored as attributes: `github.audit.action`, `github.audit.actor`, `github.audit.org`, `github.audit.repo`, `github.audit.visibility`, `github.audit.programmatic_access_type`, `github.audit.hashed_token`, and `github.audit.deploy_key_fingerprint`. The log time is GitHub's `@timestamp`.

## Troubleshooting

**Check endpoint fails** — Confirm the **Domain** is only the hostname of your intake URL, with no scheme or path, and that the port is `443`.

**Stream paused** — GitHub keeps up to seven days of events while a stream is paused and sends them when it resumes.

## Further reading

> [card] [Streaming the audit log](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise)
>
> GitHub's guide to enterprise audit log streaming.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.