Series
Working with GitHub audit log evidence
4 posts in this series. Read them in order or jump to any one.
- How to export the GitHub audit log (UI, API, streaming)
Export the GitHub audit log for forensics: UI JSON/CSV, REST API with include=all, streaming files, Git events and Actions logs, with the limits of each source.
- GitHub audit log analysis: step-by-step in your browser
Analyze GitHub audit log exports offline: drop JSON, Git events and Actions logs, read the verdict, triage findings, pivot on tokens and IPs, export a report.
- GitHub supply chain attack investigation: a walkthrough
A fictional GitHub supply chain attack investigated end to end: stolen PAT, 38 repos cloned, AWS keys printed by a workflow, branch protection removed.
- GitHub audit log limitations: retention, gaps, plans
What the GitHub audit log does not record: 180-day and 7-day retention, plan limits for API and Git events, hidden IPs, no file contents or secret reads.