GitHub Enterprise Audit Log connector for Microsoft Sentinel

The GitHub audit log connector provides the capability to ingest GitHub logs into Microsoft Sentinel. By connecting GitHub audit logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process.

Note: If you are intended to ingest GitHub subscribed events into Microsoft Sentinel , Please refer to GitHub (using Webhooks) Connector from "Data Connectors" gallery.

Connector attributes

Connector attribute	Description
Log Analytics table(s)	GitHubAuditData
Data collection rules support	Not currently supported
Supported by	Microsoft Corporation

Query samples

All logs

{{graphQueriesTableName}}

| take 10

Prerequisites

To integrate with GitHub Enterprise Audit Log make sure you have:

• GitHub API personal access token: You need a GitHub personal access token to enable polling for the organization audit log. You may use either a classic token with 'read:org' scope OR a fine-grained token with 'Administration: Read-only' scope.
• GitHub Enterprise type: This connector will only function with GitHub Enterprise Cloud; it will not support GitHub Enterprise Server.

Vendor installation instructions

Connect the GitHub Enterprise Organization-level Audit Log to Microsoft Sentinel

Enable GitHub audit Logs. Follow this to create or find your personal key

Next steps

For more information, go to the related solution in the Azure Marketplace.