![\"Image](\"https:\/\/devblogs.microsoft.com\/all-things-azure\/wp-content\/uploads\/sites\/83\/2024\/10\/HC0400_MS_AzureDeveloperBlogSeries-Banner_103124_DC_V2-02-2.png\")
<\/p>\n<\/p>\n
<\/i>Tips<\/strong><\/p>In today\u2019s rapidly evolving DevSecOps landscape, the need for real-time visibility into developer activity and security events has never been more critical. GitHub, as a central platform for code collaboration, generates a wealth of audit log data that can provide deep insights into repository changes, user actions, and potential security threats. However, these logs are often underutilized due to lack of native visualixation. To address this gap, Microsoft has introduced a powerful integration strategy that streams GitHub audit logs into Azure Log Analytics using a lightweight, low-latency pipeline. This blog explores the key observability trends, challenges, and strategic rationale behind this integration, and how it aligns with enterprise security goals.<\/div><\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n Recommended schema:<\/p>\n <\/p><\/blockquote>\n<\/div>\nKey Observability Trends Around GitHub Security<\/h3>\n
Modern enterprises are increasingly adopting DevSecOps practices, integrating security into every phase of the development lifecycle. Key observability trends include:<\/div>\n\n
Challenges in Displaying All Security in One Dashboard<\/h3>\n
Despite GitHub\u2019s robust security features, customers face several challenges:<\/div>\n\n
Why Visualizing GitHub Audit Logs in Defender Makes Sense<\/h3>\n
Integrating GitHub audit logs into Microsoft Defender offers several advantages:<\/div>\n\n
Microsoft\u2019s solution strategically aligns GitHub and Azure security under a unified framework:<\/div>\n\n
The rationale is rooted in addressing a critical visibility and response gap:<\/div>\n\n
In this blog we will share how GitHub audit logs can be moved into Azure with seconds-level latency, strong observability, and full control. If you care about centralizing GitHub security signals in Azure, this path keeps the pipeline short and the feedback loop tight.<\/div>\nIf you\u2019re exploring DevOps security on Azure, this overview is a good primer: https:\/\/learn.microsoft.com\/en-us\/azure\/defender-for-cloud\/defender-for-devops-introduction<\/span><\/a><\/div>\n<\/div>\nThe Roads We Tried but Skipped<\/h2>\n
\n
The Path That Worked: GitHub Streaming \u2192 HEC Simulator \u2192 DCR \u2192 LAW<\/h2>\n
We use GitHub Audit Log Streaming (push) to hit a Splunk HEC\u2013compatible webhook (a small \u201cHEC simulator\u201d service). The service stores a local copy and forwards events directly to Azure Log Analytics via Logs Ingestion API (DCR\/DCE). Short path, low latency, and easy to see what\u2019s going on.<\/div>\nArchitecture:<\/div>\n<\/div>\n
Five Steps to Roll Out<\/h2>\n
\n
github_auditlogs_CL<\/code> in LAW<\/a><\/li>\n<\/ol>\n\n\n\n
\n\n
\n \n Column<\/span><\/div>\n<\/td>\n\n Type<\/span><\/div>\n<\/td>\n\n Description<\/span><\/div>\n<\/td>\n<\/tr>\n<\/thead>\n\n\n \n TimeGenerated<\/span><\/div>\n<\/td>\n\n datetime<\/span><\/div>\n<\/td>\n\n Event time (derived from <\/span>created_at<\/span><\/code> in milliseconds)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n Action<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Action name (e.g., repo.rename)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n Actor<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Actor login<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n ActorId<\/span><\/div>\n<\/td>\n\n long<\/span><\/div>\n<\/td>\n\n Actor user ID<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n ActorIp<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Actor IP address<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n ActorIsBot<\/span><\/div>\n<\/td>\n\n boolean<\/span><\/div>\n<\/td>\n\n Whether the actor is a bot<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n ActorLocationCountry<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Country\/region code (e.g., SG\/US\/CN)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n Business<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Business\/enterprise name (if applicable)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n BusinessId<\/span><\/div>\n<\/td>\n\n long<\/span><\/div>\n<\/td>\n\n Business\/enterprise ID (if applicable)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n CreatedAt<\/span><\/div>\n<\/td>\n\n long<\/span><\/div>\n<\/td>\n\n Creation timestamp in milliseconds<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n DocumentId<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n GitHub document ID (<\/span>_document_id<\/span><\/code>)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n OldName<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Old name (e.g., for repo rename)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n OperationType<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Operation type (modify\/create\/delete)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n Organization<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Organization name<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n OrganizationId<\/span><\/div>\n<\/td>\n\n long<\/span><\/div>\n<\/td>\n\n Organization ID<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n PublicRepo<\/span><\/div>\n<\/td>\n\n boolean<\/span><\/div>\n<\/td>\n\n Whether the repository is public<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n Repository<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Full repository name (org\/repo)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n RepositoryId<\/span><\/div>\n<\/td>\n\n long<\/span><\/div>\n<\/td>\n\n Repository ID<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n RequestId<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Request ID (traceability)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n UserAgent<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n User-Agent string<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n Visibility<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Repo visibility (public\/internal\/private)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n RawData<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Original JSON as string (or use dynamic if preferred)<\/span><\/div>\n<\/td>\n<\/tr>\n\n \n TenantId<\/span><\/div>\n<\/td>\n\n string<\/span><\/div>\n<\/td>\n\n Azure tenant ID (optional)<\/span><\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/blockquote>\n<\/div>\n<\/div>\n