Integration
GitHub
The organization audit log: repository, member, team, secret, workflow and settings changes, read every 5 minutes with a read-only token (GitHub Enterprise Cloud).
- Category: Identity and SaaS
- How data is sent: Logthread reads the API with a token you create (nothing to install)
- Status: Beta
How it works#
- Answer a few questions. A read-only API token for GitHub and where to read from. The token is stored encrypted and never shown again; Logthread reads with it and changes nothing in your account.
- Logthread reads GitHub every 5 minutes. There is nothing to install or paste: the poll starts as soon as the connector is created and carries on from where it left off, with every event sent once.
- Data arrives. Events from GitHub appear under the service github within minutes. The connection page shows the last poll, what arrived and any error from the API, and turns Active with the first record.
What you answer#
| Question | Answer | Notes |
|---|---|---|
| Organization | Text | The organization login, as in github.com/<org>. |
| Access token | Secret (stored encrypted, never shown) | A fine-grained token with Administration: Read-only, or a classic token with read:audit_log; stored encrypted. |
Setup#
These are the steps for the default answers. In the app, they follow your answers, and the connector's ingest key replaces YOUR_INGEST_KEY.
Step 1. Create a token that can read the audit log. GitHub: Settings, Developer settings, Personal access tokens, Fine-grained: owner = your organization, Organization permissions, Administration: Read-only (or a classic token with read:audit_log). The organization needs GitHub Enterprise Cloud for the audit log API. Paste it in the form above; it is stored encrypted and never shown again.
Step 2. Logthread reads the audit log. Every 5 minutes, from where it left off: repository, member, team, secret, workflow and settings events with the actor, repository and, for enterprise owners, the source address. Nothing is changed in GitHub.
Check that it works#
The connection page under Integrations counts what has arrived and turns Active with the first record. In Explore, search service:github.
Then add#
Each is one click on the connection page and opens with your data, so you can check it before saving.
- Dashboard: GitHub: Audit events over time, the most active actors and repositories, destructive and permission changes, and token and secret events from the organization audit log.
- Alert: GitHub repository deleted or made public:
service:github github.action:(repo.destroy OR repo.access OR repo.transfer), at least 1 in 10 minutes - Alert: GitHub branch protection overridden:
service:github github.action:protected_branch.policy_override, at least 1 in 10 minutes
Set it up under Integrations in the app, or from an AI agent with MCP (add_integration). All integrations: Integrations guide. Next: find what it sends in Explore and live tail.