What is a primary benefit of configuring audit log streaming to an external destination?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Streaming pushes audit events out to your SIEM as they happen so SOC can alert — not leave logs only in GitHub's UI retention window. Wire it to Azure/AWS/Splunk/etc., monitor stream health, and do not treat streaming as a way to erase evidence or elevate privileges.
Full explanation below image
Full Explanation
The correct answer is near real-time delivery to SIEM/storage for detection and longer retention. Audit log streaming complements in-product audit search with enterprise SOC workflows. Option B undermines compliance. Option C is false. Option D is false. Validate destination credentials, encrypt in transit, alert on stream failures, and map critical events (org policy changes, permission grants, repo visibility) to detections. Streaming does not replace access reviews or break-glass procedures, but it is how mature enterprises keep GitHub administrative activity inside their detection stack beyond native retention limits.