Connect read-only
A GitHub Enterprise Cloud organization owner installs the Flare GitHub App with organization Administration read-only access. Flare verifies the installation and organization identity before linking.
Organization security activity
Investigate GitHub audit log changes with source evidence
Review owner promotions, repository visibility changes, ruleset changes and branch-protection overrides, GitHub App access, and fine-grained token activity. Each supported finding cites the exact source event, states what it cannot prove, and shows what to verify next.
Early access. Connect an organization you own for a saved 30-day retrospective, then run manual checks when needed.
Review GitHub Enterprise Cloud organization changes
Coverage includes organization web audit events from GitHub Enterprise Cloud. Git operations, repository contents, personal security logs, enterprise-wide audit streams and GitHub Enterprise Server are excluded. This is separate from Flare’s available GitHub Actions integrations.
Review supported changes
A bounded report identifies directly observed changes with source IDs, review priority, caveats and explicit coverage limits.
Investigate the evidence
Review the fetched event count, partial-coverage warnings, and exact GitHub source IDs for supported changes. Findings use deterministic rules; unsupported actions receive no finding. Audit events are never sent to an AI provider, raw events are never stored, and saved results are deleted after 90 days.
A saved review, starting with the last 30 days
When you connect an organization, Flare checks its last 30 days automatically and saves the result. Run manual checks of the last day, 7 days or 30 days, or inspect any completed window of up to 24 hours without saving it.
30-day retrospective on install
The first review starts as soon as the organization is connected. It is saved for 90 days and opens in your investigation history, alongside up to 10 manual checks per day.
Up to 300 events per day
Flare checks the window in 24-hour intervals, fetching at most three pages or 300 web events per interval. Other events on the queried UTC dates can consume this allowance. Intervals that reach the limit are marked partial, and the review names the incomplete days.
Coverage before conclusions
See covered, partial or no events observed, plus normalized and quarantined counts. No finding is not proof of no activity: unsupported actions remain counted without a finding.
See what changed, and what the event cannot prove
Supported observations include organization and team membership, specific ruleset changes, branch-policy overrides, App changes, fine-grained token requests or grants, and security-setting changes such as a repository made public or secret scanning turned off. A “Not seen in 90 days” label marks people, apps and tokens Flare hasn’t seen in the last 90 days of retained coverage. Review priority helps you choose where to look; it is not a verdict of malicious intent.
Member became an owner
Reported only when the event records a member-to-owner transition. The event does not establish whether the change was approved.
App gained repository access
Reported when an installation gains access to named repositories. Added access does not prove the App read or changed repository data.
GitHub App updated
An update was recorded. This alone does not identify which settings changed or whether permissions expanded.
Before you connect
Who can connect?
A signed-in Flare user who owns a GitHub Enterprise Cloud organization on github.com. Free and Team organizations, Enterprise Server and dedicated ghe.com domains are outside this connector. Each organization links to one Flare account.
Do I need a token or private key?
No. Start from Flare, install the Flare Audit Log App and complete GitHub authorization. The App requests organization Administration read-only access and no repository contents or write permission.
Can I return to a review later?
Yes. Retrospectives and manual checks are saved for 90 days and appear in your investigation history. Raw audit events are never stored, audit events are not sent to an AI provider, and follow-up chat isn’t available for GitHub. Only the optional 24-hour window inspector is unsaved.
Does disconnecting revoke access?
Disconnecting removes the organization from Flare and deletes its saved GitHub reviews immediately. To revoke provider access, an organization owner must also uninstall Flare Audit Log in GitHub.
Useful audit-log answers without a SIEM project
Bounded access and retention
Flare uses read-only App access and deterministic rules. GitHub audit events are not sent to an AI provider. Reviews are saved for 90 days. Raw events and GitHub user or installation tokens are not stored.
Using another source?
Explore Google Workspace audit coverage, access requirements and availability.
Saved audit reviews
See what changed in GitHub Enterprise Cloud.
Connect an organization you own for a saved 30-day retrospective. Run manual checks of the last day, 7 days or 30 days, or use the unsaved 24-hour inspector. Weekly scheduling, deploy-triggered reports, uploads and follow-up chat are not available for this connector.
Open GitHub audit report