Question

You are the enterprise administrator for a GitHub Enterprise Cloud account with several organizations. Your security team asks you to identify every instance where a repository was changed from private to public across all organizations over the past 90 days, and they want this data pulled programmatically into their SIEM on a recurring schedule. Which approach best satisfies this requirement using native GitHub Enterprise capabilities?

Accepted Answer

Query the enterprise audit log using the audit log API, filtering on the repo.access action, and configure the SIEM to poll it on a schedule

Answer

Ask each organization owner to review their organization's Security tab and manually export a CSV of repository setting changes

Answer

Enable repository rulesets at the enterprise level to block visibility changes, since blocked events are the only ones logged

Answer

Configure a webhook on each repository for the 'repository' event and forward the payloads to the SIEM