Datadog Guide Shows How to Hunt for Threats in GitHub Audit Logs

Article Details

Defense Focus

Hunt for compromised GitHub accounts and tokens by identifying anomalous authentication, OAuth authorization, secret enumeration, private-repository discovery, and bulk source-code collection in GitHub audit logs.

Detection Methods

• Flag successful sign-ins from unrecognized devices and locations; correlate subsequent account activity with identity-provider logs and approved proxy or VPN use.
• Detect newly authorized or uncommon OAuth applications, review their scopes, and track their activity across event types using hashed_token.
• Identify high-volume secret-listing API requests by actor and distinct repositories over time; inspect programmatic_access_type, url_path, and hashed_token.
• Detect organization repository pagination by counting distinct page values, and investigate sequential page increases or requests specifying private repositories.
• Find unusual reads of private repository trees or contents by counting distinct repositories accessed; treat recursive Git Trees requests as more suspicious.
• Monitor successful API requests across repository routes and resources, grouping by actor, repository, token, and short time window.
• Detect non-bot cloning or ZIP downloads across many private repositories in a short period, and compare breadth, pace, repositories, user agent, IP, ASN, geography, device, and timing with the user's baseline.
• Investigate failed access attempts against internal repository routes for evidence that private repository names or IDs have leaked.

Data Sources

• GitHub audit logs, including api.request, user.sign_in_from_unrecognized_device_and_location, oauth_authorization.create, git.clone, and repo.download_zip events.
• Identity-provider audit logs for authentication events targeting GitHub.
• User, token, application, repository, and organization activity fields including actor, external_identity_nameid, hashed_token, programmatic_access_type, oauth_application_name, token_scopes, route, url_path, query_string, status_code, repository visibility fields, source IP, user agent, and ASN.

Rule Types

• GitHub audit-log query and correlation rules
• Datadog Cloud SIEM out-of-the-box detection rules

Platforms

• GitHub
• Datadog Cloud SIEM

Defensive Actions

• Establish baselines for users, bot accounts, OAuth applications, repositories, user agents, geolocations, and normal collection activity.
• Maintain an inventory of authorized applications, who authorized them, and their scopes; review newly authorized applications regularly.
• Correlate suspicious events across the affected account's activity and isolate token-specific behavior using hashed_token.
• Compare source IP, ASN, geography, device, and user agent with the account's history; prioritize unfamiliar hosting, VPN, or Tor origins and activity without a corresponding interactive login.
• Validate unusual collection with users and rule out new-device setup, onboarding, development-environment rebuilds, scripts, backups, and misconfigured CI runners.
• Turn useful hunting queries into detection rules or continuous hunts, calibrated to organization size and normal activity.