> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> Receive security events from GitHub Team and Free organizations

<Info>
  This integration covers GitHub Team and Free organizations with real-time
  GitHub App webhooks. GitHub Enterprise Cloud customers should use the
  [GitHub Enterprise Cloud integration](/integrations/github-enterprise-cloud)
  for organization audit-log coverage.
</Info>

The GitHub integration receives security-relevant changes to organization
membership, repositories, branch protection, deploy keys, and GitHub security
alerts. Wirespeed indexes users and repositories for
investigation and runs managed detections against the events.

## Before you connect

* Have a GitHub organization owner available to complete or approve the
  Wirespeed GitHub App installation.
* Review and accept the App's read-only organization **Members**, repository
  **Administration**, Dependabot, secret-scanning, and code-scanning
  permissions.
* Choose the repositories the App should monitor. Events from repositories
  outside the App installation are not visible to Wirespeed.

## Connect GitHub

1. In Wirespeed, open
   [Settings → Integrations](https://app.wirespeed.co/settings/integrations?tab=browse)
   and select **GitHub**.
2. Review these instructions, then select **Integrate**.
3. In GitHub, choose the Team or Free organization to monitor.
4. Choose all repositories or select the repositories that Wirespeed should
   monitor, then install the App.
5. Authorize the App when GitHub prompts you. GitHub returns you to Wirespeed
   when the connection is ready.

Repeat the connection flow for each organization that should be monitored.

<Note>
  Deleting the Wirespeed connection does not uninstall the GitHub App. Remove
  the App under **Organization Settings → GitHub Apps** when the connection
  should stop sending events.
</Note>

## Data collection

Collection starts when the App is installed. GitHub webhooks do not provide
historical events or backfill activity that occurred before installation.

Wirespeed subscribes to:

* Organization members, membership, and teams
* Repository lifecycle and visibility changes
* Branch protection, repository rulesets, and deploy keys
* Wirespeed GitHub App lifecycle and repository access changes
* Dependabot, secret-scanning, and code-scanning alerts when those GitHub
  features are enabled

<Note>
  **Dependabot alerts** can be turned on for every repository under **Settings
  → Advanced Security**. The dependency graph must be enabled first. **Secret
  scanning** runs on public repositories. Public repositories can use **code
  scanning**, and Wirespeed receives those events only after it is set up with
  CodeQL default setup or a workflow. Private repositories need GitHub Secret
  Protection or GitHub Code Security. Without that license, Wirespeed receives
  no events for those features. An organization owner can enable the available
  features for many repositories under **Organization settings → Security →
  Advanced Security → Configurations**.
</Note>

<Note>
  GitHub Team and Free do not expose the Enterprise organization audit-log API.
  Webhooks generally do not include actor IP addresses, Git clone/access
  activity, SAML or organization two-factor changes, personal access token
  grants, or a historical backfill.
</Note>

## Detections

Wirespeed includes managed detections for:

* Organization administrator access grants
* Repositories made public or transferred
* Branch protection changes
* Deploy keys added to repositories
* New or reopened secret-scanning alerts
* High or critical code-scanning and dependency alerts


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.