Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

Git events

Audit log entries for Git operations (git.clone, git.fetch, git.push), kept only seven days and needed to detect mass cloning.

Git events are the audit log entries that record Git operations over HTTPS or SSH: git.clone, git.fetch and git.push. They carry the actor, the repository, the transport protocol and, when available, the source IP and the hashed token of the credential used.

They are not in the web interface export. You get them through the REST API with include=git or include=all, the enterprise "Export Git Events" menu, or audit log streaming, all on GitHub Enterprise Cloud. GitHub keeps them for seven days, and operations made through the web UI or the API are excluded. They are the evidence for repository exfiltration.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.