What's changed: New GH-100 Chapter 5 (monitoring usage & activity = analyze audit logs/API usage, SIEM streaming, admin vs Support triage and diagnostics, usage patterns [adoption/activity/underutilized features]; cost & performance optimization = usage reports for metered products [Actions minutes/storage/Packages/Copilot/GHAS], Actions cost optimization [filters/concurrency/caching/matrix/runner], reclaim unused seats, cut waste without lowering quality)
5.1Monitoring Enterprise Usage and Activity
Understand analyzing audit logs and API usage, distinguishing admin vs GitHub Support responsibilities and generating diagnostics, and evaluating usage patterns (adoption, activity, underutilized features).
Admins continuously monitor whether the enterprise is used safely, efficiently, and correctly. GH-100 tests analyzing audit logs and API usage, triaging issues (admin vs Support), and evaluating usage patterns (how much is adopted, where activity is, which features are underused).
5.1.1Analyzing audit logs and API usage
The audit log records "who did what, when," the basis for security, compliance, and troubleshooting (Chapter 3). Stream to a SIEM for long-term retention and correlation as needed. For API usage, analyze which tokens/apps call the API how much and whether they approach rate limits—excessive calls or anomalous patterns can signal inefficiency or abuse. This visibility detects and addresses issues early.
5.1.2Responsibility triage and diagnostics
Triage issues found via monitoring into admin-resolvable (settings/permissions) vs GitHub Support cases (Chapter 2). Platform outages and product bugs go to Support; systemic GHES troubles go to Support with a support bundle/diagnostics. Admins follow "resolve within my scope → escalate to Support if insufficient," avoiding both needless escalation and neglect.
5.1.3Evaluating usage patterns
Admins evaluate Enterprise usage patterns to improve ROI—adoption (which orgs/teams use how much), activity (active repos/users, stagnant areas), and underutilized features (enabled-but-unused GHAS, Actions, etc.). Discovering underuse is an opportunity for education/rollout; conversely, excessive use is a candidate for cost/risk review. Decide "where to grow, where to tighten" based on data.
Common: (1) Analyze the audit log (who/when/what) + API usage (call volume/approaching rate limits) for early detection; stream to a SIEM as needed. (2) Triage admin-resolvable vs Support cases; for GHES attach a support bundle/diagnostics. (3) Evaluate usage patterns—adoption/activity/underutilized features—to drive education/rollout or cost review.
Watch out: (1) Audit logs deliver value only with regular analysis, not mere recording. (2) Automation hitting API rate limits should use a GitHub App over a PAT (Chapter 3). (3) Underutilized ≠ waste—judge necessity and promote use via education, or retire if unneeded. (4) Monitoring data is sensitive—restrict access appropriately.
5.1.4Section summary
- Analyze audit log (who/when/what) + API usage (volume/rate limits); stream to a SIEM as needed
- Triage admin-resolvable vs Support cases; for GHES attach a support bundle/diagnostics
- Evaluate usage patterns (adoption/activity/underutilized features) for education/rollout or cost review
- Audit logs deliver value with regular analysis; monitoring data is sensitive—restrict access
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to analyze "who did what, when" to detect policy changes or anomalous actions. What do you use?
Q2. You found an enabled-but-barely-used GHAS feature. As an admin, appropriate action?
Q3. Among issues found via monitoring, which typically goes to GitHub Support?
Q4. Which is appropriate to track when analyzing API usage?
Q5. What is the problem with operating the audit log as "record only"?
Q6. Which combination is appropriate to look at when evaluating usage patterns?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.