​

GitHub organization audit logs

Coming soon. GitHub audit log connections are not available yet. Planned support covers membership, repository-setting and permission changes in a verified organization. Flare’s PR security check and other GitHub Actions integrations are available today and are separate from this connector.

​

What Flare reads

Flare reads organization web audit events through GitHub’s organization audit-log API. Git operations (such as clone, fetch and push), repository contents, personal security logs, enterprise-wide audit endpoints and GitHub Enterprise Server are excluded.

​

Before connecting

Use an organization owner in GitHub Enterprise Cloud. This connector does not claim full audit API access for GitHub Free or Team. Know the organization name from its GitHub URL, such as your-organization; do not enter a repository or personal account. The OAuth application requests read:audit_log and offline_access for read-only audit access and token renewal when the provider issues refresh tokens. Your organization’s OAuth-app restrictions and SAML SSO policies may require an owner’s separate approval or authorization. Follow your organization’s policy.

​

Setup when access is enabled

These steps apply only when GitHub access is enabled for your account. Until then, Connectors shows Coming soon.

1. Open Connectors and select GitHub.
2. Enter the organization name and choose Connect GitHub.
3. Sign in as the intended organization owner, review the requested access and authorize it through your organization’s permitted flow.
4. Confirm the organization name and ID shown by Flare. Flare checks audit access before saving the connection.
5. Choose Run an analysis, name the run, select a window and inspect the GitHub audit coverage panel beside the findings.

The immutable organization ID is bound to the connection. A changed name or identity must be verified through reconnect; Flare will reject a mismatched account.

​

Availability and limits

GitHub audit log analysis is coming soon. New connections and analyses are unavailable while this source is disabled. Existing saved results and disconnect remain accessible. Each account supports one connection per provider; reconnecting replaces that provider’s connection when access is enabled. Choose a window of up to 30 days. A run retains up to 1,000 unique in-window provider records for analysis across the selected streams. Provider requests have separate page, byte and time limits and may read additional duplicate or out-of-window records. The coverage panel reports the streams read and whether collection was truncated. Available history and reporting delays depend on the provider. An empty result means no events were observed in this query, not that the account had no activity or risk. Only manual runs are supported for this source. Scheduled runs, deploy webhooks and file uploads under this source label are unavailable. Existing GitHub Actions integrations are separate features, not an audit-log collector.

​

Troubleshooting

​

Disconnect and deletion

Disconnect removes the encrypted credentials stored in Flare and cancels pending authorization attempts. Existing analyses, selected supporting excerpts and follow-up conversations remain available until deleted. Disconnect is separate from provider-side revocation: remove Flare’s access in the provider’s application settings as well if you want to revoke the grant. Flare projects supported audit metadata before analysis. Selected fields are processed by the AI model; results, selected evidence and frequency baselines support later investigation. Full message, file or repository contents are not collected by these connectors. Review Privacy or request account deletion through Support. Never send passwords, OAuth tokens or authorization codes to Support.

​

Provider references

GitHub organization audit-log REST API · Review organization audit logs