GitHub / SCM #

• Audit log - org/enterprise; retention 180d UI, 7yr via log streaming (Enterprise). Export to Splunk, Datadog, S3, Azure Event Hubs. ts: each event has @timestamp (Unix epoch milliseconds UTC) and created_at (same, redundant). git.clone, git.fetch, git.push events are only emitted with log streaming enabled - don't assume they're in a historical pull. Native git-commit times inside the repo (git log --format=%aI) are attacker-controllable (set via GIT_AUTHOR_DATE/GIT_COMMITTER_DATE) and should always be cross-referenced with push-event ts in the audit log.
• Watch events: repo.create, repo.destroy, repo.transfer, repo.change_visibility (private→public), oauth_authorization.create, personal_access_token.create, ssh_key.create, deploy_key.create, git.clone (Enterprise + log streaming only, critical for exfil detection), repository_vulnerability_alert.*, business.update_member_repository_creation_permission, org.update_member_privilege_setting, protected_branch.* changes.
• git.clone event - proves exfil of code. Only in log streaming Enterprise.
• PAT / fine-grained PAT and OAuth app abuse - long-lived tokens from infostealers. Rotate them as part of containment.
• GitHub Actions - compromised workflows / self-hosted runners / third-party action with secrets access; supply chain. Audit workflow_run and secret access.
• Branch protection & signed commits - attackers disable required reviews, push signed-looking commits w/ forged author.
• Dependabot / secret scanning / Advanced Security - mine for leaked creds pre- and post-breach.
• Lazarus / UNC4899 target developers; reviewdog / tj-actions supply chain Mar 2025 is a reference incident.