GitHub (using Webhooks) V2

>**NOTE:** This connector is built on an HTTP trigger based Azure Function using the **Logs Ingestion API (CLv2)** with **Managed Identity** authentication. There is no need to configure a Workspace Key — authentication is handled automatically by the Function App's system-assigned managed identity. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.

>**(Optional Step)** Securely store the GitHub Webhook Secret in Azure Key Vault. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.

**Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function** >**IMPORTANT:** Before deploying the Github Webhook V2 connector, have the **Log Analytics Workspace Name** ready. The connector resources (Function App, DCE, DCR, table) must be deployed to the **same resource group** as the Log Analytics workspace.

Workspace Name

Option 1 - Azure Resource Manager (ARM) Template

Use this method for automated deployment of the GitHub V2 data connector using an ARM Template. 1. Click the **Deploy to Azure** button below. [](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FGitHub%2FData%2520Connectors%2FGithubWebhookV2%2Fazuredeploy_GithubWebhookV2_API_FunctionApp.json) 2. Select the **Subscription** and **Resource Group** — deploy to the **same resource group** as your Log Analytics workspace. > **NOTE:** You can't mix Windows and Linux apps in the same region and resource group. 3. Enter the **WorkspaceName** — the name of your Log Analytics workspace (not the full resource ID). 4. Optionally enter a **GithubWebhookSecret** to enable payload signature validation. 5. Mark the checkbox labeled **I agree to the terms and conditions stated above**. 6. Click **Purchase** to deploy.

Option 2 - Manual Deployment of Azure Functions

Use the following step-by-step instructions to deploy the GitHub V2 webhook data connector manually with Azure Functions.

Step 1 - Deploy a Function App

1. Download the [Azure Function App](https://aka.ms/sentinel-GitHubWebhookAPIV2-functionapp) file. Extract archive to your local development computer. 2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode. 3. After successful deployment of the function app, follow next steps for configuring it.

Step 2 - Configure the Function App

1. Go to Azure Portal for the Function App configuration. 2. In the Function App, select the Function App Name and select **Configuration**. 3. In the **Application settings** tab, select **New application setting**. 4. Add each of the following application settings individually, with their respective string values (case-sensitive): DCE_ENDPOINT - The logs ingestion endpoint of your Data Collection Endpoint DCR_RULE_ID - The immutableId of your Data Collection Rule DCR_STREAM_NAME - Custom-GitHubAdvancedSecurityAlerts_CL GithubWebhookSecret (optional) - Your GitHub webhook secret for payload validation 5. Once all application settings have been entered, click **Save**. 6. Ensure the Function App has a **System Assigned Managed Identity** enabled. 7. Grant the Managed Identity the **Monitoring Metrics Publisher** role on your Data Collection Rule.

**Post Deployment steps**

STEP 1 - To get the Azure Function url

1. Go to Azure function Overview page and Click on "Functions" in the left blade. 2. Click on the function called "GithubWebhookConnectorV2". 3. Go to "GetFunctionurl" and copy the function url.

STEP 2 - Configure Webhook to Github Organization

1. Go to [GitHub](https://www.github.com) and open your account and click on "Your Organizations." 2. Click on Settings. 3. Click on "Webhooks" and enter the function app url which was copied from above STEP 1 under payload URL textbox. 4. Choose content type as "application/json". 5. Subscribe for events and Click on "Add Webhook"

*Now we are done with the GitHub Webhook V2 configuration. Once GitHub events are triggered, after the delay of 5 to 10 mins, you should be able to see all the transactional events from GitHub in the LogAnalytics workspace table called `GitHubAdvancedSecurityAlerts_CL`. Use the `githubscanaudit` parser function for a unified view that includes data from both the legacy `githubscanaudit_CL` and new `GitHubAdvancedSecurityAlerts_CL` tables.*

⚠️ IMPORTANT: Migrating from GitHub Webhook V1 to V2

If you are currently using the original **GitHub (using Webhooks)** connector (`githubscanaudit_CL` table), follow these steps to migrate to V2 without disrupting existing data or breaking workbooks and analytic rules. **Before you begin:** Both connectors can run side-by-side. V1 data lands in `githubscanaudit_CL` and V2 data lands in `GitHubAdvancedSecurityAlerts_CL`. The `githubscanaudit()` parser function unions both tables so all workbooks, analytic rules, and hunting queries continue to work unchanged during and after migration. **Migration Steps:** 1. **Deploy V2 alongside V1.** Complete all steps above to deploy the GitHub Webhook V2 Function App. Do not remove V1 yet. 2. **Verify V2 is receiving events.** Update the GitHub webhook payload URL in your GitHub Organization settings (**Settings → Webhooks**) to point to the new V2 Function App URL. Trigger some GitHub events and confirm data appears in `GitHubAdvancedSecurityAlerts_CL` within 5–10 minutes. 3. **Validate the unified parser.** Run `githubscanaudit() | sort by TimeGenerated desc | take 50` in Log Analytics to confirm both V1 and V2 data appears under the same schema. 4. **Disable the V1 Function App.** Once V2 is confirmed working, stop the original V1 Function App to prevent duplicate event ingestion: - In the Azure Portal, navigate to your original GitHub Webhook V1 Function App. - Under **Overview**, click **Stop** to halt execution. - Optionally, update the GitHub webhook payload URL to point exclusively to the V2 endpoint. 5. **Retain V1 data.** The `githubscanaudit_CL` table data is subject to your Log Analytics workspace retention policy. No action is required — historical V1 data continues to be queryable via `githubscanaudit()` until it ages out per your retention settings. > **⚠️ Warning:** Do **not** delete the V1 Function App resources until you have verified V2 is fully operational and you no longer need to roll back. Running both simultaneously does **not** cause duplicate ingestion as long as only one webhook URL is active in GitHub at a time.