What does 'audit log streaming' to an external SIEM provide that standard audit log export does not?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The key difference is time. Export means you pull a file at some interval — you might miss events that happened between your last export and your next one. Streaming pushes each event to your SIEM within seconds of it happening. No gaps, no lag, real-time detection.
Full explanation below image
Full Explanation
GitHub Enterprise Cloud audit log streaming (to Amazon S3, Azure Blob Storage, Google Cloud Storage, Splunk, or Datadog) provides advantages over periodic exports: (1) Near real-time delivery — events are streamed within seconds/minutes of occurring. (2) No gaps — no risk of missing events between export intervals. (3) Continuous storage — events are continuously written to the destination without manual intervention. (4) Integration with SIEM tools — direct streaming to Splunk or other SIEM tools enables immediate alerting on suspicious activity. (5) Scale — handles high event volumes without manual export management. Standard audit log export (via UI or API) is periodic and manual, creating time windows where events exist in GitHub but haven't been exported. For compliance and security monitoring, streaming eliminates these gaps.