Why This Matters

For regulated industries, audit logs are mandatory. Copilot generates audit events (policy changes, seat changes); ingesting into SIEM enables alerting and compliance reporting.

Concept Explained

Copilot audit events appear in GitHub's audit log: seat assignments, policy changes, login events. Use GitHub's audit log API or streaming to ingest into SIEM.

How It Works

Use GitHub audit log API to fetch Copilot events. Stream to SIEM (Splunk, ELK, Datadog). Alert on: policy changes, bulk seat changes, unusual access patterns.

Step-by-Step Tutorial

1. Identify Copilot events

2. Fetch via audit log API

3. Stream to SIEM

4. Alert

5. Compliance report

Real-World Example

A fintech ingested Copilot audit events into Splunk. Built alerts: policy change → alert security; bulk seat change → alert SOC. Caught a misconfigured policy change within 5 minutes; would have taken days to notice manually.

Example Prompts / Commands / Code

import requests

ORG = 'your-org'
TOKEN = 'YOUR_GITHUB_TOKEN'

r = requests.get(
    f'https://api.github.com/orgs/{ORG}/audit-log',
    headers={'Authorization': f'Bearer {TOKEN}'},
    params={'phrase': 'copilot', 'per_page': 100}
)

for event in r.json():
    if event['action'].startswith('copilot'):
        print(f'{event["created_at"]} - {event["action"]} - {event["actor"]}')

Alert on:
- copilot.policy_changed → security team
- copilot.seat_bulk_assigned (>5 at once) → SOC
- copilot.seat_bulk_cancelled (>5 at once) → SOC
- copilot.login_after_hours → security team
- copilot.policy_drift → compliance team

Compliance report (monthly):
- Total Copilot users
- Total credits used
- Policy changes (count, who, what)
- Seat changes (assignments, cancellations)
- Any alerts triggered

Common Mistakes

• Not ingesting audit logs — no visibility into changes.
• Alerting on everything — alert fatigue.
• Not generating compliance reports — auditors ask, you scramble.
• Forgetting after-hours access is suspicious.

Best Practices

• Ingest Copilot events into SIEM.
• Alert on: policy changes, bulk seat changes, after-hours access.
• Generate monthly compliance reports.
• Tune alerts to avoid fatigue.
• Test alerting regularly.

Troubleshooting

Practical Exercise

Professional Challenge

Frequently Asked Questions

Further Reading

• GitHub audit log API

Official References

• GitHub audit log API

Related lessons: PR-11, PR-12