Skip to main content
This integration covers GitHub Team and Free organizations with real-time GitHub App webhooks. GitHub Enterprise Cloud customers should use the GitHub Enterprise Cloud integration for organization audit-log coverage.
The GitHub integration receives security-relevant changes to organization membership, repositories, branch protection, deploy keys, and GitHub security alerts. Wirespeed indexes users and repositories for investigation and runs managed detections against the events.

​
Before you connect

  • Have a GitHub organization owner available to complete or approve the Wirespeed GitHub App installation.
  • Review and accept the App’s read-only organization Members, repository Administration, repository Contents, repository Deployments, Dependabot, secret-scanning, and code-scanning permissions. GitHub requires Contents to deliver push and release events and Deployments to deliver deploy key events; Wirespeed uses them only to receive event metadata and does not read repository files.
  • Choose the repositories the App should monitor. Events from repositories outside the App installation are not visible to Wirespeed.

​
Connect GitHub

  1. In Wirespeed, open Settings → Integrations and select GitHub.
  2. Review these instructions, then select Integrate.
  3. In GitHub, choose the Team or Free organization to monitor.
  4. Choose all repositories or select the repositories that Wirespeed should monitor, then install the App.
  5. Authorize the App when GitHub prompts you. GitHub returns you to Wirespeed when the connection is ready.
Repeat the connection flow for each organization that should be monitored.
Deleting the Wirespeed connection does not uninstall the GitHub App. Remove the App under Organization Settings → GitHub Apps when the connection should stop sending events.

​
Data collection

Collection starts when the App is installed. GitHub webhooks do not provide historical events or backfill activity that occurred before installation. Wirespeed subscribes to:
  • Organization members, membership, and teams
  • Repository lifecycle and visibility changes
  • Branch protection rules, branch protection being enabled or disabled for a repository, repository rulesets, and deploy keys
  • Code security features being enabled or disabled for a repository
  • Pushes, including the ref, before and after SHAs, force-push and branch create/delete flags, the pusher, and commit authors, messages, and changed file paths for up to the first 100 commits of each push. Very large pushes may have shortened commit messages and partial lists of changed paths
  • Forks and releases
  • Wirespeed GitHub App lifecycle and repository access changes
  • Dependabot, secret-scanning, and code-scanning alerts when those GitHub features are enabled
  • Secret scanning push protection and push ruleset bypass requests, and Dependabot, secret-scanning, and code-scanning alert dismissal requests, when the organization uses delegated bypass or delegated alert dismissal
Dependabot alerts can be turned on for every repository under Settings → Advanced Security. The dependency graph must be enabled first. Secret scanning runs on public repositories. Public repositories can use code scanning, and Wirespeed receives those events only after it is set up with CodeQL default setup or a workflow. Private repositories need GitHub Secret Protection or GitHub Code Security. Without that license, Wirespeed receives no events for those features. An organization owner can enable the available features for many repositories under Organization settings → Security → Advanced Security → Configurations.
GitHub Team and Free do not expose the Enterprise organization audit-log API. Webhooks generally do not include actor IP addresses, Git clone/access activity, SAML or organization two-factor changes, personal access token grants, or a historical backfill.

​
Permission updates

When Wirespeed adds a permission to the GitHub App, existing installations keep their previous permissions until an organization owner approves the request. GitHub does not send events that need the new permission until then. Wirespeed shows a GitHub App permissions warning under Entitlements on the integration page while a request is pending. To approve it:
  1. Hover over the warning and select Review in GitHub, or open Organization Settings → GitHub Apps → Wirespeed → Configure.
  2. Select Review request and accept the new permissions.
Only GitHub organization owners can approve permission requests. The warning clears automatically once GitHub reports the approval, and the connection in Wirespeed does not need to be reconnected.

​
Detections

Wirespeed includes managed detections for:
  • Organization administrator access grants
  • Repositories made public or transferred
  • Branch protection changes
  • Deploy keys added to repositories
  • New or reopened secret-scanning alerts
  • High or critical code-scanning and dependency alerts