Wiz Shares VCS Logging and Threat-Hunting Guidance for GitHub, GitLab, Bitbucket, and Azure DevOps

Summary

Wiz CIRT's VCS DFIR guide maps log sources, readiness settings, and audit events across four platforms to help security teams improve visibility, investigate incidents, and hunt for attacker activity.

Key points

The guide covers GitHub, GitLab, Bitbucket, and Azure DevOps, comparing available logs and audit events across platforms and deployment types.
Default log availability and retention can leave investigation gaps; GitHub retains Git read/write events for seven days by default, while standard GitLab configurations do not save Git operations to the database.
The article recommends configuring log streaming before an incident and extending retention so teams can investigate activity discovered weeks or months later.
Readiness guidance includes capturing complete metadata, such as source IP addresses in GitHub audit logs, and retaining logs outside the VCS platform.
A detection and forensic matrix maps attacker tactics to platform-specific audit event names to support threat hunting and detection engineering.
In a Wiz CIRT investigation, a compromised token was used to mass-clone repositories containing plaintext secrets; incomplete historical clone logs prevented precise scoping and led to broad credential rotation.
The article notes that self-hosted systems can provide access to deeper host and network telemetry, but require organizations to manage and secure the environment.

Article Details

Defense Focus: Improve version control system (VCS) incident readiness and detection through audit-log visibility, retention, and platform-specific hunting of suspicious activity.
Detection Methods: Stream VCS audit logs before an incident to support real-time detection and historical investigations.
Hunt provider-specific audit events associated with mass repository cloning and workflow execution log deletion.
Compare available event types, retention limits, and logging gaps across VCS platforms when planning investigations.
Monitor for behavioral anomalies using the audit events mapped in the poster's Attack Detection and Forensic Matrix.
Data Sources: VCS audit logs, including Git read/write events and API request logs where available
Source IP addresses recorded in audit logs when configured
Workflow execution logs and related audit events
For self-hosted deployments: raw HTTP request logs, database errors, application exception logs, and network and host ingress/egress traffic logs
Rule Types: Provider-specific audit-event hunting queries
Platforms: GitHub
GitLab
Bitbucket
Azure DevOps
Defensive Actions: Preconfigure log streaming to a detection platform or external datastore, and verify the necessary VCS license tier supports it.
Enable complete audit metadata, including source IP logging where available.
Extend log retention by streaming events externally; do not rely on default retention for investigations.
Review each platform's accessible audit events and logging gaps before an incident.
Establish baseline configurations and monitor for anomalous VCS activity.
Consider branch protections, plaintext-secret scanning, restricted token scopes, MFA, and IP allowlists as broader posture measures.

Threat Actors

TeamPCPSupply chain campaigns discussed in the article are attributed to TeamPCP.

Vendors

WizTo assist security teams, Wiz CIRT has created a Version Control Digital Forensics and Incident Response (DFIR) poster summarizing available logs, a pre-incident configuration checklist, and specific audit event names

Products

Azure DevOpsto focus on the four most common VCS platforms across Wiz customers: GitHub, GitLab, Bitbucket, and Azure DevOps.Azure DevOps Serverare exclusively available in the cloud service and are not natively supported in on-premises Azure DevOps Server deployments.BitbucketWe chose to focus on the four most common VCS platforms across Wiz customers: GitHub, GitLab, Bitbucket, and Azure DevOps.GitHubduring an investigation. We chose to focus on the four most common VCS platforms across Wiz customers: GitHub, GitLab, Bitbucket, and Azure DevOps.GitLaban investigation. We chose to focus on the four most common VCS platforms across Wiz customers: GitHub, GitLab, Bitbucket, and Azure DevOps.Wiz DefendWiz Defend natively ingests audit logs from supported VCS platforms. Customers benefit from built-in, real-time detections that automatically monitor for the tactics and techniques detailed in the matrix.