On GitHub Enterprise Cloud, audit log streaming copies audit and git events to storage or a monitoring tool you control, such as Amazon S3, Azure Blob Storage, Splunk or Datadog. Delivery is at least once, so expect duplicates, and a broken stream must be fixed within days or events drop.
What the stream contains
GitHub's documentation says the stream carries both audit events and git events across the entire enterprise account, starting from the moment you enable it. Data arrives as compressed JSON files with date based names, which makes it easy to load into a log tool.
Supported destinations listed on the page include Amazon S3, Azure Blob Storage, Azure Event Hubs, Datadog, Google Cloud Storage and Splunk. Streaming to more than one endpoint is described as public preview.
Setup in four steps
- Prepare the destination, for example a bucket with write access for GitHub.
- In enterprise settings, open Audit log, then Log streaming.
- Choose your provider under Configure stream and enter the connection details. S3 supports access keys or OpenID Connect.
- Click Check endpoint, then Save.
Prefer OpenID Connect over long lived access keys where it is offered, so there is no static credential to rotate or leak.
Operational facts that bite later
- Delivery is at least once. Deduplicate on read.
- Health checks run every 24 hours. A misconfigured stream must be fixed within six days to avoid dropped events.
- A paused stream is buffered for seven days. After three weeks or more no data is retained.
- Datadog accepts logs only up to 18 hours old, so a long pause there risks loss.
Put an alert on the receiving side: if no file has arrived in a day, someone should know.
Retention is now your decision
Once the data lands in your storage, retention follows your policy, not GitHub's. Set it to match your longest audit window, restrict who can delete, and keep a short note describing the stream for the next auditor. If you are on a plan without streaming, a scheduled manual export is the fallback. Either way, test the path once a quarter by pulling a sample event, such as a branch rule change, and confirming it arrived intact.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the monitoring demo and watch how a stream of events turns into alerts you can act on.
Click through it at your own pace, or open it full screen.
Quick check
Will I get duplicate events?
Yes, GitHub documents at-least-once delivery, so some events may be duplicated.
Is streaming available for personal accounts?
The documentation is written for Enterprise Cloud enterprise accounts.
Sources
Last reviewed: 19 October 2026.
