API requests are available via audit log streaming – Public Beta

[tuves]

GitHub is the software development platform trusted by millions of developers. With this trust comes a responsibility to constantly improve our security, audit, and compliance solutions with the developer in mind. A high-quality audit log is an essential tool for enterprises to ensure compliance, maintain security, investigate issues, and promote accountability. GitHub has been working hard to add new features to help enterprises gain more visibility into their organizations’ software development and collaboration activities, and operate with greater peace of mind when it comes to security and compliance.

GitHub Enterprise Cloud customers can now join a public beta for streaming API request events as part of their enterprise audit log.

As part of this beta, REST API calls against enterprise's private and internal repositories can be streamed to one of GitHub's supported streaming endpoints.

Check out our changelog for instructions to enable the feature and blog for more information!

[ManikOfficial]

Nice

[tonglil]

Can you consider providing a per-repo audit log interface so that repo owners (like teams) can see what happened in a repo, such as branch protection rules being changed, without needing org owner access?

[boylejj]

👋🏻 @tonglil, audit log PM here. This is something that we can consider. One alternative we have been considering is having the ability to assign a read audit log role to non-org owners? This would allow users to be assigned a "read audit log" role by the organization owner, allowing them to query the organization's audit logs without org owner permissions. Would this be a slightly different way of addressing the feedback you've provided? Please let me know what you think.

[tonglil]

That's a fine solution, however it would be better to grant audit logs to individual repos based on their roles in their team.

For example, the admins (or other role) of a repo can view the audit logs of that repo.

Viewing it on the repo-level also provides granularity that's scoped to that repo (essentially prefixes the repo query) so it's much more digestible. This is a perspective coming from an org with thousands of repos, and right now typing repos in is really slow in the UI.

FWIW, I know GH is trying to get search interfaces to look and act the same, but the audit log UI/UX is not that great, particularly when you want to see a timeline of what happened, or figure out if X changed. The query names are sometimes non-intuitive and there's no mapping (that I've been able to find in docs) that correlates what to what in the repo's setting page.

[boylejj]

Would you be willing to meet with me to discuss your Org/Repository use case, and better understand how the Audit Log U/I could be refactored to better support the types of searches you're typically performing?

[tonglil]

I'm happy to share my feedback.

[kumavis]

Feature Request:

a button here (or similar) for those with access to the audit log to navigate to the audit logs filtered for this repo

[rumon5h]

Just awesome

[gdcraigmunday]

Does this new feature also include the streaming of audit events for package reads? That is, when a user downloads a package from a repository?