Full Report
A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services.
Analysis Summary
# Best Practices: Version Control System (VCS) DFIR & Threat Hunting
## Overview
These practices address the critical visibility gaps in Version Control Systems (GitHub, GitLab, Bitbucket, and Azure DevOps). They focus on shifting from basic security enforcement to **investigative readiness**, ensuring that when a supply chain or targeted attack occurs, security teams have the necessary logs, metadata, and telemetry to reconstruct attacker activity.
## Key Recommendations
### Immediate Actions
1. **Audit License Tiers:** Review your current VCS licensing (e.g., GitHub Enterprise, GitLab Ultimate) to identify what logs are natively available versus restricted.
2. **Enable Source IP Logging:** In GitHub, manually toggle the setting to include actor source IP addresses in audit logs; this is often disabled by default and critical for tracing origins.
3. **Check Retention Settings:** Verify default retention (e.g., GitHub's 7-day limit for Git events) and extend it to at least 90 days or until log streaming is established.
4. **Enforce MFA & PAT Controls:** Review Personal Access Token (PAT) expiration dates and scopes to minimize the impact of credential theft.
### Short-term Improvements (1-3 months)
1. **Implement Log Streaming:** Configure real-time streaming of audit and system logs to a centralized Cloud Detection and Response (CDR) or SIEM platform to bypass UI/API search limitations.
2. **Configure API Logging:** For supported platforms (GitHub), enable explicit API request logging to detect early-stage discovery and enumeration by threat actors.
3. **Deploy Audit Event Monitoring:** Set up alerts for high-risk events: repository visibility changes, MFA disables, and new SSH key additions.
### Long-term Strategy (3+ months)
1. **Operationalize the DFIR Matrix:** Integrate VCS-specific event names into your Incident Response Playbooks (e.g., mapping `org.disable_saml` or `repo.access` events to specific response steps).
2. **Telemetry Correlation:** Build automated correlations between VCS logs and Cloud Provider logs (AWS/Azure/GCP) to track attackers moving from code repositories to cloud infrastructure.
3. **Zero Trust for Git:** Move toward short-lived credentials and eliminate long-standing PATs where possible.
## Implementation Guidance
### For Small Organizations
* **Focus:** Core security hygiene.
* **Action:** Enable MFA for all users, use the default UI for log reviews weekly, and manually export logs monthly to a secure storage bucket to overcome short retention periods.
### For Medium Organizations
* **Focus:** Centralized visibility.
* **Action:** Upgrade to license tiers that support log streaming. Direct logs to a budget-friendly CDR/SIEM to maintain historical data for at least 6 months.
### For Large Enterprises
* **Focus:** Advanced threat hunting and API security.
* **Action:** Enable full API metadata logging. Integrate VCS telemetry into a Global Security Operations Center (GSOC) for real-time correlation across the CI/CD pipeline and production environments.
## Configuration Examples
**GitHub Source IP Exposure:**
* Navigate to **Organization Settings** > **Archives** > **Log settings**.
* Ensure **"Include IP addresses in audit logs"** is enabled.
**General Log Streaming (Conceptual):**
* VCS Platform -> Webhook/Stream -> Amazon S3 / Azure Blob Storage -> CDR Platform.
* *Note:* Ensure the streaming service has the `admin:org` or equivalent permission to access the full audit stream.
## Compliance Alignment
* **NIST 800-53:** AU-2 (Event Logging) and AU-6 (Audit Record Review).
* **ISO/IEC 27001:** Annex A.12.4 (Logging and Monitoring).
* **CIS Benchmarks:** Software Supply Chain Security guidelines for GitHub and GitLab.
## Common Pitfalls to Avoid
* **The 7-Day Trap:** Assuming logs will be there when you need them. Most VCS platforms have extremely short default retention for "noisy" events like Git clones/pulls.
* **Missing API Context:** Only monitoring UI-based actions while ignoring API-based discovery (where 90% of automated attacks occur).
* **License Ignorance:** Discovering during an incident that your current license tier does not provide the logs needed for a forensic timeline.
## Resources
* **Wiz CIRT DFIR Poster:** [https://threats.wiz.io/posters-newspapers] (Provides specific event names for hunting).
* **GitHub Audit Log Documentation:** [https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise]
* **GitLab Audit Event Schema:** [https://docs.gitlab.com/ee/administration/audit_event_streaming.html]