mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
34 lines
1.6 KiB
YAML
34 lines
1.6 KiB
YAML
name: GitHub Enterprise Audit Logs
|
|
id: 8a4d656f-8801-4a2c-ae10-553d2696a59f
|
|
version: 2
|
|
creation_date: '2024-07-16'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Data source object for GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
|
|
source: http:github
|
|
sourcetype: httpevent
|
|
supported_TA:
|
|
- name: Splunk Add-on for Github
|
|
url: https://splunkbase.splunk.com/app/6254
|
|
version: 3.2.0
|
|
fields:
|
|
- _document_id
|
|
- action
|
|
- actor
|
|
- actor_id
|
|
- actor_is_bot
|
|
- business
|
|
- business_id
|
|
- created_at
|
|
- operation_type
|
|
- org
|
|
- org_id
|
|
- public_repo
|
|
- repo
|
|
- repo_id
|
|
- request_access_security_header
|
|
- user
|
|
- user_agent
|
|
- user_id
|
|
example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 }'
|