Streaming the audit logs for organizations in your enterprise account

Enterprise owners can stream audit and Git events data from GitHub to an external data management system.

Enterpriseアカウントは、GitHub Enterprise Cloud、GitHub Enterprise Serverで利用できます。 詳細は「Enterprise アカウントについて」を参照してください。

Note: Audit log streaming is currently in beta for GitHub Enterprise Cloud and subject to change.

About exporting audit data

You can extract audit log and Git events data from GitHub in multiple ways:

About audit log streaming

To help protect your intellectual property and maintain compliance for your organization, you can use streaming to keep copies of your audit log data and monitor:

  • Organizationもしくはリポジトリ設定へのアクセス
  • 権限の変更
  • Organization、リポジトリ、Teamへのユーザの追加もしくは削除
  • 管理者に昇格したユーザ
  • GitHub Appの権限の変更
  • クローン、フェッチ、プッシュなどの Git イベント

The benefits of streaming audit data include:

  • Data exploration. You can examine streamed events using your preferred tool for querying large quantities of data. The stream contains both audit events and Git events across the entire enterprise account.
  • Data continuity. You can pause the stream for up to seven days without losing any audit data.
  • Data retention. You can keep your exported audit logs and Git data as long as you need to.

Enterprise owners can set up, pause, or delete a stream at any time. The stream exports the audit data for all of the organizations in your enterprise.

Setting up audit log streaming

GitHub supports streaming of audit data to Splunk, Azure Event Hubs, and Amazon S3.

You set up the audit log stream from the Log streaming tab of the Audit log page in your enterprise settings.

  1. GitHub.comの右上で、自分のプロフィール写真をクリックし、続いてYour enterprises(自分のEnterprise)をクリックしてください。 GitHub Enterprise Cloudのプロフィール写真のドロップダウンメニュー内の"Your enterprises"

  2. Enterpriseのリストで、表示したいEnterpriseをクリックしてください。 Enterpriseのリスト中のEnterpriseの名前

  3. Enterpriseアカウントのサイドバーで、 Settings(設定)をクリックしてください。 Enterpriseアカウントサイドバー内の設定タブ

  4. Settings(設定)"の下で、Audit logをクリックしてください。 Enterpriseアカウントのサイドバー内のAudit logタブ

  5. Click the Log streaming tab.

From the Log streaming tab you can set up an audit log stream by following the steps in one of the sections below.

Setting up streaming to Splunk

To stream audit logs to Splunk's HTTP Event Collector (HEC) endpoint you must make sure that the endpoint is configured to accept HTTPS connections. For more information, see the Splunk documentation article "Set up and use HTTP Event Collector in Splunk Web."

  1. Go to the Log streaming tab in your enterprise settings. For more information, see "Navigating to the Log streaming tab."

  2. Click Configure stream and select Splunk. Choose Splunk from the drop-down menu

  3. On the configuration page, enter:

    • The domain on which the application you want to stream to is hosted.

      If you are using Splunk Cloud, Domain should be http-inputs-<host>, where host is the domain you use in Splunk Cloud. たとえば、http-inputs-mycompany.splunkcloud.com などです。

    • The port on which the application accepts data.

      If you are using Splunk Cloud, Port should be 443 if you haven't changed the port configuration. If you are using the free trial version of Splunk Cloud, Port should be 8088.

    • A token that GitHub can use to authenticate to the third-party application. Enter stream settings

  4. Leave the Enable SSL verification check box selected.

    Audit logs are always streamed as encrypted data, however, with this option selected, GitHub verifies the SSL certificate of your Splunk instance when delivering events. SSL verification helps ensure that events are delivered to your URL endpoint securely. You can clear the selection of this option, but we recommend you leave SSL verification enabled.

  5. Click Check endpoint to verify that GitHub can connect to the Splunk endpoint. Check the endpoint

  6. After you have successfully verified the endpoint, click Save.

Setting up streaming to Azure Event Hubs

Before setting up a stream in GitHub, you must first have an event hub namespace in Microsoft Azure. Next, you must create an event hub instance within the namespace. You'll need the details of this event hub instance when you set up the stream. For details, see the Microsoft documentation, "Quickstart: Create an event hub using Azure portal."

You need two pieces of information about your event hub: its instance name and the connection string.

On Microsoft Azure portal:

  1. In the left menu select Entities. Then select Event Hubs. The names of your event hubs are listed. A list of event hubs
  2. Make a note of the name of the event hub you want to stream to.
  3. Click the required event hub. Then, in the left menu, select Shared Access Policies.
  4. Select a shared access policy in the list of policies, or create a new policy. A list of shared access policies
  5. Click the button to the right of the Connection string-primary key field to copy the connection string. The event hub connection string

On GitHub:

  1. Go to the Log streaming tab in your enterprise settings. For more information, see "Navigating to the Log streaming tab."
  2. Click Configure stream and select Azure Event Hubs. Choose Splunk from the drop-down menu
  3. On the configuration page, enter:
    • The name of the Azure Event Hubs instance.
    • The connection string. Enter stream settings
  4. Click Check endpoint to verify that GitHub can connect to the Azure endpoint. Check the endpoint
  5. After you have successfully verified the endpoint, click Save.

Setting up streaming to Amazon S3

To stream audit logs to Amazon's S3 endpoint, you must have a bucket and access keys. For more information, see the AWS documentation "Creating, configuring, and working with Amazon S3 buckets." Make sure to block public access to the bucket to protect your audit log information.

To set up audit log streaming from GitHub you will need:

  • The name of your Amazon S3 bucket
  • Your AWS access key ID
  • Your AWS secret key

For information on creating or accessing your access key ID and secret key, see the AWS documentation "Understanding and getting your AWS credentials."

  1. Go to the Log streaming tab in your enterprise settings. For more information, see "Navigating to the Log streaming tab."
  2. Click Configure stream and select Amazon S3. Choose Amazon S3 from the drop-down menu
  3. On the configuration page, enter:
    • The name of the bucket you want to stream to. For example, auditlog-streaming-test.
    • Your access key ID. For example, ABCAIOSFODNN7EXAMPLE1.
    • Your secret key. For example, aBcJalrXUtnWXYZ/A1MDENG/zPxRfiCYEXAMPLEKEY. Enter stream settings
  4. Click Check endpoint to verify that GitHub can connect to the Amazon S3 endpoint. Check the endpoint
  5. After you have successfully verified the endpoint, click Save.

Pausing audit log streaming

Pausing the stream allows you to perform maintenance on the receiving application without losing audit data. Audit logs are stored for up to seven days on GitHub.com and are then exported when you unpause the stream.

  1. Display the "Log streaming" tab, as described above.
  2. Click Pause stream. Pause the stream
  3. A confirmation message is displayed. Click Pause stream to confirm.

When the application is ready to receive audit logs again, click Resume stream to restart streaming audit logs.

Deleting the audit log stream

  1. Display the "Log streaming" tab, as described above.
  2. Click Delete stream. Delete the stream
  3. A confirmation message is displayed. Click Delete stream to confirm.

このドキュメントは役立ちましたか?

プライバシーポリシー

これらのドキュメントを素晴らしいものにするのを手伝ってください!

GitHubのすべてのドキュメントはオープンソースです。間違っていたり、はっきりしないところがありましたか?Pull Requestをお送りください。

コントリビューションを行う

OR, コントリビューションの方法を学んでください。

問題がまだ解決していませんか?