Skip to content
Sign In
Telemetry

github:audit

GitHub audit log

Host type
Identity providers and SaaS (Okta, GitHub, Slack, ...)
Tier, as a whole
Minimum
Cost class
Included
Techniques
2
Rules listed
68
Events
24

Licensing

License or service
GitHub (org owners); API needs Enterprise Cloud
What is free
Web UI; 180-day retention
What costs
GraphQL/REST audit log API "Organizations that use GitHub Enterprise Cloud"
Notes
Plan gating for web UI not stated
Vendor page
https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization
As read on
2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Techniques

Rules

Splunk 18
Sigma 15
Elastic 33
Microsoft Sentinel 2

Events

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.