Summary
For git events in the enterprise audit log events where a personal access token (classic), fine-grained personal access token (FGP), OAuth token, SSH key or deploy key was used as the method of authentication, the audit log will contain a hashed rendering of the token or key used for authentication and the programmatic_access_type field describing the type of token/key used for authentication. In doing so, customers will be able to query actions a specific token or key has been used to perform on enterprise assets.
Intended Outcome
Compromised tokens and keys have the potential to provide threat actors with access to private data. After learning of a compromise, administrators and security professionals want to understand the actions taken using the corrupted key or token. To support Enterprise customers to complete these investigations, we will enhance the audit log data by logging identifiable and queryable authentication metadata in the audit log for events.
How will it work?
The audit log will display the authentication method using the programmatic_access_type field, as well a SHA256 hash of the token or key used for authentication. Customers will be able to search for a specific hashed_token to identify the specific actions taken using a specific key or token. This data will be available in the GitHub enterprise account UI, the audit log API, exports and streaming.
Summary
For git events in the enterprise audit log events where a personal access token (classic), fine-grained personal access token (FGP), OAuth token, SSH key or deploy key was used as the method of authentication, the audit log will contain a hashed rendering of the token or key used for authentication and the
programmatic_access_typefield describing the type of token/key used for authentication. In doing so, customers will be able to query actions a specific token or key has been used to perform on enterprise assets.Intended Outcome
Compromised tokens and keys have the potential to provide threat actors with access to private data. After learning of a compromise, administrators and security professionals want to understand the actions taken using the corrupted key or token. To support Enterprise customers to complete these investigations, we will enhance the audit log data by logging identifiable and queryable authentication metadata in the audit log for events.
How will it work?
The audit log will display the authentication method using the
programmatic_access_typefield, as well a SHA256 hash of the token or key used for authentication. Customers will be able to search for a specifichashed_tokento identify the specific actions taken using a specific key or token. This data will be available in the GitHub enterprise account UI, the audit log API, exports and streaming.