---
id: 6762
title: "Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/vcs-dfir-threat-hunting-github-gitlab-azure-devops"
published_at: "2026-08-27T12:00:00Z"
tags: ["cloud", "supply-chain", "gitlab", "incident-response", "threat-intelligence", "github", "threat-hunting", "dfir", "bitbucket", "azure-devops"]
phying_url: "https://phying.com/item/6762"
lang: en
---

# Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

## Summary

Wiz CIRT's VCS DFIR poster covers GitHub, GitLab, Bitbucket and Azure DevOps: retention gaps (GitHub keeps Git events 7 days; GitLab stores none), API-log availability, and audit events to hunt.

## Why it matters

This guide equips DFIR and SecOps teams with structured hunting queries and artifact locations across major SCM platforms.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-08-27T12:00:00Z
- **Original:** https://www.wiz.io/blog/vcs-dfir-threat-hunting-github-gitlab-azure-devops
- **Phying News:** https://phying.com/item/6762