OWASP notes that the relevant logs are not enabled by default in many of these systems, and platforms keep what they do log for a limited time. After an incident such as tj-actions, the questions of which jobs ran, what they printed and which tokens were used can only be answered from logs someone kept.
- Inventory the systems in the delivery chain, including every self-managed instance.
- Enable their audit logs, for human and programmatic access alike, and ship them to a central store before the platform's retention expires.
- Correlate events across systems, so a change that moves from repository to build to deployment can be followed.
- Alert on anomalies in each system and in the release flow as a whole.
Guides on this site
Gaps on this site
The tj-actions case study shows how to pull and scan workflow logs from an exposure window. No guide here collects source control and CI audit logs centrally or writes detections for a pipeline.
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.