How does one-time audit log export differ from continuous audit log streaming?
Select an answer to reveal the explanation.
Short Explanation
You use export as a batch snapshot, while streaming is the firehose for SIEM. Use export for investigations and offline analysis, and streaming for ongoing detection. Export doesn't see the future, and streaming is enterprise audit scale—not public issue comments only.
Full Explanation
The correct distinction is point-in-time export versus continuous forwarding of new events. Enterprises often use both: streaming for the security operations center, and export for specific legal holds or ad hoc analysis. The claim that export always includes future events that have not occurred yet is impossible. The claim that streaming only works for public repositories' issue comments understates streaming scope. The claim that export disables the web audit log UI permanently is false. Ensure exported files are stored in access-controlled compliance buckets with encryption, and verify that streaming destinations remain healthy so you do not discover a silent gap only during an incident investigation months later.