> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Audit Log Streaming

> Demonstrates configuring GitHub Enterprise audit log streaming to Datadog, generating audit events, and verifying streamed logs for retention, alerting, and analysis.

In this lesson you'll configure audit log streaming for a GitHub Enterprise account and verify the streamed events in a third-party log service (Datadog). This demonstrates how administrative and repository activity is captured by GitHub and forwarded to external observability platforms for retention, alerting, and analysis.

The Audit log view shows events generated by user and admin activity across organizations and enterprises.

![A dark-themed GitHub Enterprise settings page for the "NextGen Gaming" organization showing the Audit log view with recent events, filters, and export buttons. The event list shows authorization and token-related entries (e.g., actions by "sid-dev2-kk").](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Audit-Log-Streaming/nextgen-gaming-ghe-audit-log-tokens.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=29db9722ba8819cdd422cc5f9f948599)

What is Log Streaming?

* GitHub Enterprise can forward audit events to supported destinations so you can centralize logs, run queries, create alerts, or retain data outside GitHub.
* Supported destinations include cloud storage and observability tools such as Amazon S3, Google Cloud Storage, Azure Event Hubs, Datadog, and Splunk.

Open the Log streaming configuration in your Enterprise settings and choose a destination.

![A dark-themed GitHub Enterprise settings page open to Audit log → Log streaming with a "Configure stream" dropdown expanded and "Azure Event Hubs" highlighted. The left sidebar shows other settings like General, Authentication security, and Hooks.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Audit-Log-Streaming/github-enterprise-audit-logstream-azure-eventhubs.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=31d617974e8eec8f13c238fe65e853fd)

Streaming to Datadog — prerequisites

* You need a Datadog API key and must select the Datadog site/region that matches your account (for example, use `ap1.datadoghq.com` for the AP1 region).
* Create a clear name for the key (e.g., `GitHub Logs`) so you can identify it later.

To obtain the API key in Datadog:

1. Open Datadog → Organization settings → API Keys.
2. Create a new API key (name it like `GitHub Logs`).
3. Copy the generated key and paste it into GitHub's Log streaming configuration.

![A Datadog web dashboard showing the Organization Settings → API Keys page with a "New API Key" modal open for "github-logs," the key partially visible and a tooltip saying "Copied to clipboard." The background shows the API keys list and the left-hand navigation menu.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Audit-Log-Streaming/datadog-api-keys-github-logs-copied.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=cb0a3f2d1a188f94775e052d568e3026)

Configure the Datadog stream in GitHub Enterprise

* In the GitHub Log streaming UI:
  * Select Datadog as the destination.
  * Paste your Datadog API key.
  * Choose the Datadog site/region (for example, `AP1` → `ap1.datadoghq.com`).
  * Use the "Validate endpoint" button so GitHub checks the token and site details.
  * Click Save to enable the stream.

It typically takes about 10–15 minutes for streamed audit logs to start appearing in Datadog after you enable the stream.

If you want configuration screenshots or step-by-step guidance for other destinations, GitHub provides per-destination instructions.

![A screenshot of a GitHub Docs page titled "Setting up streaming to Datadog" showing numbered step-by-step instructions for configuring Datadog log streaming. The right side shows a table of contents with related audit log streaming topics.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Audit-Log-Streaming/github-docs-datadog-log-streaming-setup.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=5f34de60e400a17aa8e754fe253340a7)

Generate audit events to confirm streaming

* After saving the stream, perform administrative and repository actions in your enterprise to generate events that will flow into Datadog. In this demo the following actions were performed:
  * Switched Advanced Security configuration from “NextGen Advanced Security” to “GitHub recommended” and then back.
  * Created an internal repository `game-devstudio/test-repo-2` with a README.
  * Changed repository visibility to public.
  * Inspected deletion-related options in the repository "Danger Zone".
  * Triggered secret scanning and waited for it to complete.

When GitHub asks for two-factor authentication (TOTP) during an admin action, provide the code as prompted. Example (one-time code shown for demonstration):

```text theme={null}
931 220
```

Exporting logs directly from GitHub

* You can also request an on-demand export of audit logs (JSON or CSV). GitHub creates an export job and shows a message like:

```text theme={null}
Export job successfully created. It may take up to 1 hour to complete.
```

* Small accounts or low-volume activity often produce the export much sooner. Typical outputs are `csv.gz` or a JSON export file.

Sample UI audit entries

* The Audit log UI displays concise entries with actor, action, repository, and timestamps. Example UI-style entries:

```text theme={null}
GitHub System – secret_scanning_scan.completed
A secret scanning scan was completed for game-devstudio/test-repo-2
Unknown location | 1 minute ago

alice-admin-kk – repository_security_configuration.applied
Applied nextgen-advanced-security to game-devstudio/test-repo-2
Unknown location | 1 minute ago
▾ View SSO details
alice.gh900+ADMIN@gmail.com
```

Sample streamed audit event (JSON)

* Events streamed to destinations include rich metadata. Below is a representative JSON-style event as emitted to a streaming destination:

```json theme={null}
{
  "_document_id": "I8ZpY6qBithSa8CUJAc4YA",
  "@timestamp": 1787816138131,
  "action": "repo.access",
  "actor": "alice-admin-kk",
  "actor_id": 319981142,
  "actor_is_bot": false,
  "business": "nextgen-gaming",
  "business_id": 772436,
  "created_at": 1787816138131,
  "evt": {
    "action": "repo.access"
  },
  "external_identity_nameid": "alice.gh900+ADMIN@gmail.com",
  "github": {
    "actor": "alice-admin-kk",
    "document": {
      "id": "I8ZpY6qBithSa8CUJAc4YA"
    },
    "org": "game-devstudio",
    "repository": "game-devstudio/test-repo-2",
    "visibility": "public"
  },
  "http": {
    "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0",
    "useragent_details": {
      "browser": {
        "family": "Firefox"
      }
    }
  }
}
```

Verify events in Datadog

* Once streaming is active and events are emitted, open Datadog’s Log Explorer and search for events like `github.audit.streaming` or filter by actor, action, repository, or other fields included in the JSON payload. The Log Explorer will show a timeline graph and a list of timestamped entries with searchable facets and attributes.

![A Datadog Log Explorer screenshot showing a timeline graph at the top and a long list of timestamped "github.audit.streaming" log entries in the main pane. The left sidebar shows Datadog navigation and filter fields (Status, Activity ID, Actor details, etc.).](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Audit-Log-Streaming/datadog-log-explorer-github-audit-streaming.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=91e0faa7dc68981a7a3c73e6370a13e7)

Quick checklist

| Step | Action |
| - | - |
| 1 | Navigate to GitHub Enterprise → Audit log → Log streaming |
| 2 | Choose destination (e.g., Datadog) and paste API key |
| 3 | Select the correct Datadog site/region (e.g., `AP1` → `ap1.datadoghq.com`) |
| 4 | Validate endpoint and click Save |
| 5 | Perform admin/repo actions to generate audit events |
| 6 | Search in Datadog Log Explorer for streamed events |

Links and references

* GitHub — Streaming audit logs to a third-party service: [https://docs.github.com/](https://docs.github.com/)
* GitHub — Audit log documentation: [https://docs.github.com/en/enterprise-server@latest/admin/monitoring-and-optimization/audit-log](https://docs.github.com/en/enterprise-server@latest/admin/monitoring-and-optimization/audit-log)
* Datadog — API keys and logs documentation: [https://docs.datadoghq.com/](https://docs.datadoghq.com/)

Summary

* Configure Log streaming in GitHub Enterprise and select a supported destination (Datadog in this demo).
* Generate an API key in Datadog and select the correct site/region.
* Validate and save the stream; expect logs to appear in \~10–15 minutes.
* Perform administrative and repository actions to generate audit events.
* Verify and query those events in the destination (Datadog) and consult the destination provider’s documentation for service-specific setup, retention, and troubleshooting.

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/ddb3d739-d57f-4374-b851-69bb14cbeb8b/lesson/040556d6-ebef-495f-94b9-fa32655a1fbc)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.