# NG SIEM - GitHub Integration

### **<span style="color: rgb(53, 152, 219);">Introduction</span>**

Elastic’s GitHub integration allows you to ingest GitHub logs, alerts, and developer activities into the Elastic Stack for centralized analysis. This supports use cases like vulnerability management, compliance auditing, and DevSecOps monitoring.

<p class="callout info">Note: This integration is only compatible with **GitHub Enterprise Cloud** and is **not supported on GitHub Enterprise Server**.</p>

---

### **<span style="color: rgb(53, 152, 219);">Option 1: GitHub Audit Logs</span>**  


**Description:**  
Audit logs contain records of all administrative and security events within a GitHub organization.

#### Requirements

- GitHub Enterprise Cloud
- You must be an organization owner
- Use a Personal Access Token (PAT) with `read:audit_log` scope

#### What It Does

- Captures repository creation, permission changes, team updates, and more
- Helps detect suspicious or non-compliant behavior

#### Setup Steps

1. **Create a PAT**
    
    
    - Go to GitHub → Developer Settings → Personal Access Tokens
    - Click "Generate new token"
    - Select `read:audit_log` scope
    - Save the token securely
2. **Configure Integration in Elastic**
    
    
    - Navigate to Integrations in Kibana
    - Search for "GitHub" and click "Add GitHub integration"
    - Select the "Audit Logs" data stream
    - Enter your organization name and paste your PAT
3. **Test and Deploy**
    
    
    - Click "Test integration" to verify connectivity
    - Choose a data stream name and index settings
    - Click "Save and Deploy"
4. **Verify in Kibana**
    
    
    - Navigate to Discover
    - Use the index pattern `logs-github.audit-*`
    - Filter using fields such as `actor`, `action`, or `created_at`

---

### **<span style="color: rgb(53, 152, 219);">Option 2: Code Scanning Alerts</span>**

**Description:**  
Collect static code analysis results from GitHub Advanced Security Code Scanning.

#### Requirements

- Code Scanning must be enabled per repository
- Use either:
    
    
    - GitHub App with `security_events` read permission
    - PAT with:
        
        
        - `security_events` (for private repositories)
        - `public_repo` (for public repositories)

#### What It Does

- Ingests vulnerabilities and insecure code patterns
- Supports SARIF format scan results

#### Setup Steps

1. **Enable Code Scanning in GitHub**
    
    
    - Go to your repository → Security → Code scanning alerts
    - Enable GitHub Advanced Security
    - Configure workflows such as CodeQL
2. **Generate PAT or GitHub App**
    
    
    - If using a PAT, ensure it includes `security_events` or `public_repo` scope
3. **Configure Integration in Elastic**
    
    
    - Open Integrations in Kibana
    - Add GitHub integration and select "Code Scanning"
    - Input organization name and credentials
4. **Test and Configure**
    
    
    - Test the integration
    - Set polling frequency (e.g., every 5 minutes)
    - Save and deploy
5. **Monitor in Kibana**
    
    
    - Use Discover with the index pattern `logs-github.code_scanning-*`
    - Filter by fields such as `severity`, `rule_id`, or `repository.name`

---

### **<span style="color: rgb(53, 152, 219);">Option 3: Secret Scanning Alerts</span>**

**Description:**  
Detect and alert on exposed secrets in source code repositories.

#### Requirements

- Secret Scanning must be enabled in repository settings
- You must be a repository or organization administrator
- Use either:
    
    
    - GitHub App with `secret_scanning_alerts` read permission
    - PAT with:
        
        
        - `repo` or `security_events` (for private repos)
        - `public_repo` (for public repos)

#### What It Does

- Flags exposed API keys, tokens, and credentials
- Helps prevent credential leaks

#### Setup Steps

1. **Enable Secret Scanning**
    
    
    - Go to GitHub repo → Settings → Code Security and Analysis
    - Enable "Secret scanning alerts"
2. **Generate Access**
    
    
    - Create a PAT with appropriate scopes
    - Or set up a GitHub App with necessary permissions
3. **Configure in Elastic**
    
    
    - Go to the GitHub integration in Kibana
    - Enable the "Secret Scanning" stream
    - Provide token and repository/org details
4. **Test and Save**
    
    
    - Test the connection
    - Select desired polling interval (e.g., 10 minutes)
    - Save and deploy
5. **Analyze Alerts**
    
    
    - Open Discover and use `logs-github.secret_scanning-*`
    - Use filters such as `alert_type`, `secret_type`, and `state`

---

### **<span style="color: rgb(53, 152, 219);">Option 4: Dependabot Alerts</span>**

**Description:**  
Monitor dependency vulnerabilities in GitHub repositories using Dependabot.

#### Requirements

- Dependabot must be enabled in repository settings
- You must be a repository or organization administrator
- Use either:
    
    
    - GitHub App
    - PAT with:
        
        
        - `repo`, `security_events`, or `public_repo` scope

#### What It Does

- Identifies and alerts on known insecure packages
- Includes CVE metadata and suggested fixes

#### Setup Steps

1. **Enable Dependabot in GitHub**
    
    
    - Go to Repository → Settings → Code Security and Analysis
    - Enable "Dependency Graph" and "Dependabot alerts"
2. **Generate GitHub App or PAT**
    
    
    - Ensure scopes include `repo`, `security_events`, or `public_repo`
3. **Configure in Elastic**
    
    
    - Go to GitHub integration
    - Enable "Dependabot"
    - Enter org/repo and credentials
4. **Test and Deploy**
    
    
    - Test the integration
    - Select polling interval
    - Save settings
5. **Monitor in Kibana**
    
    
    - Use Discover → `logs-github.dependabot-*`
    - Filter by `dependency_name`, `ecosystem`, `severity`, etc.

---

### **<span style="color: rgb(53, 152, 219);">Option 5: Issues &amp; Pull Requests</span>**

**Description:**  
Ingest GitHub issues, pull requests, comments, labels, milestones, and other metadata.

#### Requirements

- Use a GitHub App or PAT with:
    
    
    - `repo` (for private repositories)
    - `public_repo` (for public repositories)
    - Optional: `read:org` for org-wide access

#### What It Does

- Collects all issue and PR activity
- Enables filtering of pull requests with `github.issues.is_pr = true`

#### Setup Steps

1. **Create or Use PAT / GitHub App**
    
    
    - Ensure appropriate access to repositories
2. **Enable GitHub Integration in Elastic**
    
    
    - Choose "Issues" as the data stream
    - Enter credentials and repository/organization name
3. **Customize Settings**
    
    
    - Set state filter (e.g., `state=open` for open issues only)
    - Configure sync interval
4. **Test and Activate**
    
    
    - Verify GitHub API connectivity
    - Deploy integration
5. **View Data in Kibana**
    
    
    - Go to Discover → `logs-github.issues-*`
    - Use filters such as `assignees`, `labels`, `state`, or `is_pr`

---

### <span style="color: rgb(53, 152, 219);">**Comparison Table**</span>  


<table border="1" id="bkmrk-feature-github-app-p" style="border-collapse: collapse; width: 100%; border-width: 1px;"><colgroup><col style="width: 16.6915%;"></col><col style="width: 11.6841%;"></col><col style="width: 11.5648%;"></col><col style="width: 32.31%;"></col><col style="width: 14.1833%;"></col><col style="width: 13.7153%;"></col></colgroup><thead><tr><td class="align-center">Feature</td><td class="align-center">GitHub App</td><td class="align-center">PAT Support</td><td class="align-center">Required Scopes</td><td class="align-center">Public Repos</td><td class="align-center">Private Repos</td></tr></thead><tbody><tr><td>Audit Logs</td><td>No</td><td>Yes</td><td>`read:audit_log`  
</td><td>No</td><td>Yes</td></tr><tr><td>Code Scanning</td><td>Yes</td><td>Yes</td><td>`security_events`, `public_repo`

</td><td>Yes</td><td>Yes</td></tr><tr><td>Secret Scanning</td><td>Yes</td><td>Yes</td><td>`repo`, `security_events`, `public_repo`</td><td>Yes</td><td>Yes</td></tr><tr><td>Dependabot</td><td>Yes</td><td>Yes</td><td>`repo`, `security_events`, `public_repo`</td><td>Yes</td><td>Yes</td></tr><tr><td>Issues &amp; PRs</td><td>Yes</td><td>Yes</td><td>`repo`, `public_repo`, `read:org`</td><td>Yes</td><td>Yes</td></tr></tbody></table>

---

### **<span style="color: rgb(53, 152, 219);">Documentation References</span>**  


- Elastic GitHub Integration: [CyTech Docs](https://usdc-docs.cytechint.io/books/system-integrations/page/github-integration#bkmrk-to-use-this-integrat-4)
- GitHub Official Docs: 
    - [Code Scanning](https://docs.github.com/en/code-security/code-scanning)
    - [Secret Scanning](https://docs.github.com/en/code-security/secret-scanning)
    - [Dependabot](https://docs.github.com/en/code-security/supply-chain-security)
    - [Issues API](https://docs.github.com/en/rest/issues/issues?apiVersion=2022-11-28)

*If you need further assistance, kindly contact our support at [support@cytechint.com](mailto:info@cytechint.com) for prompt assistance and guidance.*