Audit log streaming of API requests targeting your enterprise’s private assets is now generally available. This feature provides you as enterprise administrators new visibility into the API activity within your enterprise.
Audit logs play a critical role in an enterprise owners’ ability to monitor and secure their enterprise. Many enterprises leverage GitHub’s API ecosystem to automate and operate their enterprise at scale. However, API use can also create unique security and operational challenges that must be managed. To help manage these challenges, API requests targeting your enterprise’s private assets can be included in your enterprise’s audit log streams. Please note that API requests targeting public repositories will be omitted from your enterprise’s audit log stream. This new data will allow you as an enterprise owner to:
- Better understand and analyze API usage targeting your private enterprise assets;
- Identify and diagnose potentially misconfigured applications or integrations;
- Track the authentication tokens being used by specific applications or integrations;
- Troubleshoot API requests contributing to API rate limiting;
- Analyze API activity when performing forensic investigations; and
- Develop API specific anomaly detection algorithms to proactively identify potentially malicious API activity.
An example event payload can be found below:
Note: Sensitive fields have been redacted for security reasons.
To start streaming API requests, you can follow the instructions in our docs for enabling audit log streaming of API requests. Once enabled, you should begin seeing API request events in your audit log stream.
