GitHub · GH-100
Audit logging and reporting
GH-100 · Lesson 9 of 17 · 1:16:22
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-100 exam (GitHub Administration). In this lesson: the enterprise audit log and its retention, Git events, searching with qualifiers, exports and their limits, the audit log REST API, finding what a compromised token did, streaming to Splunk, Datadog, Azure, AWS, or Google Cloud, API request events, and incident readiness. Includes three original practice questions.
Preview the topics
- Contoso’s security team searches the audit log in the browser for an event from four months ago, and finds nothing, although events are kept for 180 days. Why?
- Contoso’s regulator requires every audit event and every Git event to be kept for seven years. What should the enterprise owner set up?
- During an investigation, Contoso needs every REST API call that a compromised token made last week, but the audit log shows no API request events at all. Why?