Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

This is a solid resource for anyone who’s had to triage an incident involving a compromised CI/CD pipeline or a leaked PAT. The major VCS platforms all have different logging schemas, retention policies, and API endpoints, which makes hunting across them a pain. This cheatsheet cuts through that.

What it covers:

• Log Visibility: A breakdown of what each platform logs by default (audit events, webhooks, SSH keys) versus what requires a premium license (e.g., GitHub Audit Log for GHES vs. standard org audit log).
• Incident Readiness: Practical guidance on configuring alerting for anomalous events like mass repo cloning, new deploy keys, or changes to branch protection rules.
• Threat Hunting: Specific queries and API calls to pull artifacts like git push events from unusual IPs, deleted repo recovery, and token usage patterns.

Why it matters for DFIR:

• Standardization: If you support multiple clients or a multi-cloud environment, you can’t memorize the API differences between GitLab’s audit_events and Azure DevOps’s AuditLog. This gives you the mapping.
• Gaps: It highlights where visibility is weak (e.g., Bitbucket Data Center’s limited logging compared to Cloud) so you know where to supplement with SIEM ingestion or custom webhooks.
• Actionable: It’s not just theory—includes direct references to log fields and API endpoints for pulling data during an active investigation.

Worth bookmarking for the next time you need to pivot from a compromised GitHub token to a full account takeover timeline.

Source: https://www.wiz.io/blog/vcs-dfir-threat-hunting-github-gitlab-azure-devops