↳ GitHub sourceConnector

[Deprecated] GitHub Enterprise Audit Log

Description

The GitHub audit log connector provides the capability to ingest GitHub logs into Microsoft Sentinel. By connecting GitHub audit logs into Microsoft Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process. **Note:** If you intended to ingest GitHub subscribed events into Microsoft Sentinel, please refer to GitHub (using Webhooks) Connector from "**Data Connectors**" gallery. <p><span style='color:red; font-weight:bold;'>NOTE</span>: This data connector has been deprecated, consider moving to the CCF data connector available in the solution which replaces ingestion via the <a href='https://learn.microsoft.com/en-us/azure/azure-monitor/logs/custom-logs-migrate' style='color:#1890F1;'>deprecated HTTP Data Collector API</a>.</p>
Declared status
1
Declared author / publisher
GitHub

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Declared permissions

read and write permissions are required.
Workspace
Workspace
GitHub API personal access token
You need a GitHub personal access token to enable polling for the organization audit log. You may use either a classic token with 'read:org' scope OR a fine-grained token with 'Administration: Read-only' scope.
GitHub Enterprise type
This connector will only function with GitHub Enterprise Cloud; it will not support GitHub Enterprise Server. 

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Connect the GitHub Enterprise Organization-level Audit Log to Microsoft Sentinel
Enable GitHub audit logs. Follow [this guide](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create or find your personal access token.

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
GitHubEcAuditLogPolling
Additional source files 2Solutions/GitHub/Data Connectors/azuredeploy_GitHub_native_poller_connector.jsonsource ↗Solutions/GitHub/data/Solution_GitHub.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.