Skip to main content
Audit logs are the definitive trail of user and administrative activity in your environment. How you capture, store, and search these logs determines whether they will be usable during an incident response, compliance audit, or forensic investigation. Without streaming, your audit log behaves like a local security camera: it records events to the host and can be altered or deleted by an attacker who gains administrative access.
A slide titled "Without Streaming — Evidence You Can Lose" showing an orange "Insider" icon pointing to a compromised admin@enterprise screen. The screen displays local audit recordings that appear crossed out or deleted.
When you enable audit log streaming, logs are sent in near real time to an external, tamper-evident store. This is similar to a casino’s live security feed: even if local records are destroyed, the streamed records remain available off-site. Many compliance regimes (for example, SOC 2, FedRAMP, and ISO standards) require real-time, tamper-evident logging or retention in an external system. You configure audit log streaming at the enterprise level. Common supported destinations include: For forensic workflows, the ability to search logs quickly and consistently is essential. GitHub’s enterprise audit log provides a unified search syntax that works both in the web UI and via the enterprise audit log API endpoint.
A clean presentation slide titled "Forensics – One Search Box" with a purple magnifying-glass icon centered above the caption "Perform forensics." The slide also shows a small "© Copyright KodeKloud" in the corner.
Common audit-log search examples:
  • Find all repository deletions:
  • Find all policy changes by a specific administrator:
These same queries can be used interactively in the GitHub UI or programmatically against the enterprise audit log API. See the enterprise audit log API docs for query parameters and pagination details: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-and-logging/auditing-for-your-enterprise
Use precise action names (for example, repo.destroy, business.set_actions_policy) and the actor: filter to narrow searches to a specific user or timeframe.
Important scoping rule to remember: user login events (for example, user.login) are only recorded in the enterprise audit log. Organization-level audit logs do not include login events. That means organization administrators can view actions performed inside their organization but they cannot see global login events — only enterprise owners can audit those login events.
A slide titled "The Scoping Rule You Must Memorize" showing side-by-side boxes for "Enterprise audit log" and "Organization audit log." It indicates enterprise logs capture user.login and actions across every organization, while organization logs only capture actions inside that organization and do not record whether/when a user logged in.
Critical: user.login and other global authentication events are visible only in the enterprise audit log. To monitor or audit logins across organizations, you must query the enterprise audit log and have enterprise-owner permissions.
Quick reference — exam and operational summary: Further reading and references: Use audit log streaming plus targeted search queries to ensure tamper-evident retention, fast forensic response, and compliance with enterprise logging requirements.

Watch Video