Understanding how GitHub Support can help during a security incident

Understand what GitHub のサポート can and cannot do during a security incident, and find resources to investigate and respond.

この記事で

About security incidents

A security incident is an event that could compromise your enterprise's accounts, code, or other data. Examples include compromised accounts, leaked credentials, unexpected access, or unauthorized changes.

Investigating and responding to an incident is self-service. Before an incident occurs, enable enterprise audit log streaming, API request event streaming, and source IP address disclosure. Retain the logs in storage that your incident responders can access.

重要

Audit log streaming only includes activity from the time you enable it. Enabling it during an incident will not recover earlier activity.

For guidance on preparing for and responding to an incident, see:

How GitHub のサポート can help

重要

When an incident occurs, follow your incident response procedures immediately. Focus first on containing the threat with actions appropriate to the incident, such as restricting access and revoking or rotating compromised credentials.

For enterprise-level containment options, see 企業におけるシングルサインオンの制限 and エンタープライズでの承認の取り消しまたは資格情報の削除.

GitHub のサポート can answer questions about GitHub's features and the data available to you, so you can investigate and analyze the activity yourself. GitHub のサポート does not investigate or analyze on your behalf.

If you need guidance using these features or want to request a feature, see サポートチケットの作成.

GitHub のサポート handles all security-related matters in writing through support tickets.

No managed incident response service

GitHub のサポート does not join or lead your incident response process. To investigate and contain a threat, use GitHub's audit log, security, and access-management tools.

No log preservation

GitHub のサポート cannot fulfill requests to preserve logs or audit data, extend their retention periods, or place them on hold for your investigation. Opening a support ticket does not change how long data remains available. To retain data for an investigation, export it while it is available or configure audit log streaming in advance to storage you control.

Further reading