Posts tagged: #incident-response

What the GitHub audit log does not record: 180-day and 7-day retention, plan limits for API and Git events, hidden IPs, no file contents or secret reads.

A fictional GitHub supply chain attack investigated end to end: stolen PAT, 38 repos cloned, AWS keys printed by a workflow, branch protection removed.

AWS, Google Cloud or Azure keys leaked from GitHub Actions or a repo: contain the key, trace its use in the cloud audit logs, then replace keys with OIDC.

GitHub organization takeover indicators in the audit log: new owners, 2FA requirement off, SAML SSO changed, IP allow list off, audit streaming removed.

Rogue or compromised GitHub self-hosted runners: the audit log events to check, host evidence in _diag, and how to scope and rebuild after an incident.

How GitHub Actions secrets leak despite *** masking: poisoned workflows, new branches, encoded output and third-party actions. The evidence to collect and read.

Find source code theft in the GitHub audit log: git.clone bursts, ZIP archive downloads, repos made public or transferred, forks, and what each leaves behind.

A GitHub PAT or OAuth token leaked? Revoke it, find its hashed_token in the audit log, check new IPs, countries and clones, then scope what the token reached.

Analyze GitHub audit log exports offline: drop JSON, Git events and Actions logs, read the verdict, triage findings, pivot on tokens and IPs, export a report.

Export the GitHub audit log for forensics: UI JSON/CSV, REST API with include=all, streaming files, Git events and Actions logs, with the limits of each source.

What to do when your GitHub organization is compromised: preserve the audit log, contain tokens and workflows, scope with Git events, then pivot to the cloud.