Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

Audit log streaming

Continuous export of a GitHub enterprise's audit and Git events to S3, Azure, GCS, Datadog or Splunk, beyond the 180-day and 7-day limits.

Audit log streaming sends a GitHub Enterprise Cloud enterprise's audit events and Git events, for all its organizations, to a destination you control: Amazon S3, Azure Blob Storage, Azure Event Hubs, Google Cloud Storage, Datadog or Splunk. Object storage receives compressed JSON lines under YYYY/MM/DD/HH/MM/<uuid>.json.log.gz.

It is the only way to keep Git events beyond seven days and audit events beyond 180 days. GitHub buffers up to seven days while a stream is paused. Removing a stream (audit_log_streaming.destroy) is a classic defense-evasion step. See organization takeover.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.