Question

Your compliance team requires that all enterprise audit log events on GitHub Enterprise Cloud be retained for seven years in a tamper-resistant store that your SIEM can query, well beyond GitHub's default retention window. The team also wants near-real-time delivery so security analysts can alert on suspicious events. As the enterprise owner, what is the most appropriate way to meet these requirements?

Accepted Answer

Configure enterprise audit log streaming to an external endpoint such as Amazon S3, Azure Blob Storage, or Splunk, and manage long-term retention there.

Answer

Increase the audit log retention period in the enterprise settings to seven years and grant analysts read access to the built-in audit log UI.

Answer

Write a scheduled GitHub Actions workflow that calls the audit log REST API nightly and commits the exported JSON to a private repository.

Answer

Enable Dependabot alerts forwarding and rely on the security overview dashboard to archive events for the required period.