Before
Security teams likely retrieved GitHub audit logs manually, selected relevant detection rules, and reviewed events one by one. Investigating suspicious activity also required separate IP reputation and location lookups before someone drafted and sent a notification.
How it works
- Collect and filter the latest GitHub audit-log events on a recurring two-hour schedule.
- Select applicable detection rules and analyze matching activity for sensitive actions, abnormal timing, location changes, IP signals, and user-agent changes.
- Enrich suspicious findings with related events and follow-up measures, then send a Slack report only when anomalous activity is identified.
Workflow details
- Scheduled collection: On a recurring two-hour schedule, the workflow retrieves GitHub organization audit logs and filters the dataset to events from the most recent two-hour window.
- Rule selection: It reviews the current audit-log batch and retrieves applicable detection rules from a configured repository, including custom or trusted open-source rule collections.
- Automated investigation: Each applicable rule is evaluated against the recent events. The analysis considers sensitive actions, event frequency, working-time patterns, user context, IP addresses, locations, client information, and changes in user agents.
- Threat enrichment: When an event appears suspicious, the workflow performs additional IP reputation and location checks and connects related events to build a rationale and recommended follow-up actions.
- Targeted alerting: An AI-generated assessment is sent to the designated Slack channel only when suspicious activity is identified, giving the security team a concise report with the event details, reasoning, linked activity, and next steps.
What changed
Audit-log collection, rule selection, event analysis, enrichment checks, and alert drafting now happen automatically on a two-hour cadence. The security team receives a targeted Slack handoff containing suspicious events, supporting rationale, linked activity, and suggested follow-up actions instead of assembling the assessment across separate tools.
Work removed
Manually pulling recent audit logs, choosing applicable detection rules, reviewing events against those rules, checking IP reputation and location changes, comparing user-agent activity, linking related events, writing investigation rationales, and drafting Slack notifications.
Expected outcome
A conservative estimate is that 10–20 recurring manual actions can be removed from each detection cycle, while suspicious activity is assessed consistently every two hours.
