Why are my GitHub Audit logs showing a latency of 10-15 minutes in Panther?

Last updated: December 11, 2025

QUESTION

Why do my GitHub audit logs have a 10–15 minutes delay in Panther when using the Panther-supported GitHub integration?

ANSWER

A latency of 10–15 minutes for GitHub Audit logs is expected in Panther, even though the system polls the GitHub API every minute.

This delay occurs due to two main factors:

  1. GitHub API delay: There is usually a small delay (a few minutes) between when an event occurs and when it becomes visible through the GitHub API.

  2. Panther processing time: Once Panther receives an event from GitHub, it goes through several internal processing steps before being fully parsed and stored in the database. This processing typically adds around 10 minutes of latency.

Combined, these factors result in the expected total latency of roughly 10–15 minutes for GitHub Audit logs.

If you're comparing GitHub audit logs to GitHub webhook logs, you may notice that webhook logs show no latency. This is because the GitHub webhook schema doesn't have an explicit timestamp for event time, so Panther automatically uses the parse time as the event time, making the two values appear identical.