Audit Log Streaming

action	Description	Sample	Rule
audit_log_streaming.check	A manual check of the endpoint configured for audit log streaming was performed.	N	N
audit_log_streaming.create	An endpoint was added for audit log streaming.	N	N
audit_log_streaming.destroy	An audit log streaming endpoint was deleted.	N	Y
audit_log_streaming.update	An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.	N	Y

audit_log_streaming.check

A manual check of the endpoint configured for audit log streaming was performed.

Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.

An endpoint was added for audit log streaming.

Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.

An audit log streaming endpoint was deleted.

Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.

GitHub Enterprise Disable Audit Log Event Stream source: The following analytic detects when a user disables audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that disable the audit log streaming functionality, which is…T1195, T1685, T1685.002

GitHub Enterprise Audit Log Stream Destroyed source high: Detects when a GitHub audit log stream is destroyed. An adversary may attempt to destroy audit logs to erase their tracks.T1562

An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.

Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.

GitHub Enterprise Modify Audit Log Event Stream source: The following analytic detects when a user modifies or disables audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that affect the audit log streaming…T1195, T1685, T1685.002
GitHub Enterprise Pause Audit Log Event Stream source: The following analytic detects when a user pauses audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that temporarily suspend the audit log streaming functionality,…T1195, T1685, T1685.002

GitHub Enterprise Audit Log Stream Modified source high: Detects when a GitHub audit log stream is modified (e.g. paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks.T1562