diff --git a/content/actions/tutorials/build-and-test-code/python.md b/content/actions/tutorials/build-and-test-code/python.md index 8b13b25a0c23..312a48eda7ff 100644 --- a/content/actions/tutorials/build-and-test-code/python.md +++ b/content/actions/tutorials/build-and-test-code/python.md @@ -297,6 +297,13 @@ steps: pytest tests.py --doctest-modules --junitxml=junit/test-results.xml --cov=com --cov-report=xml --cov-report=html ``` +{% ifversion code-quality %} + +> [!TIP] +> This example already produces a Cobertura XML coverage report (`--cov-report=xml`). To display coverage results directly on pull requests, upload the report using the `actions/upload-code-coverage` action. See [AUTOTITLE](/code-security/how-tos/maintain-quality-code/set-up-code-coverage). + +{% endif %} + ### Using Ruff to lint and/or format code The following example installs or upgrades `ruff` and uses it to lint all files. For more information, see [Ruff](https://docs.astral.sh/ruff). diff --git a/content/actions/tutorials/store-and-share-data.md b/content/actions/tutorials/store-and-share-data.md index 214e9253904b..fd148660ad9a 100644 --- a/content/actions/tutorials/store-and-share-data.md +++ b/content/actions/tutorials/store-and-share-data.md @@ -83,6 +83,13 @@ jobs: path: output/test/code-coverage.html ``` +{% ifversion code-quality %} + +> [!TIP] +> To display code coverage results directly on pull requests instead of downloading artifacts, you can upload a Cobertura XML coverage report to {% data variables.product.prodname_code_quality_short %}. See [AUTOTITLE](/code-security/how-tos/maintain-quality-code/set-up-code-coverage). + +{% endif %} + ## Configuring a custom artifact retention period You can define a custom retention period for individual artifacts created by a workflow. When using a workflow to create a new artifact, you can use `retention-days` with the `upload-artifact` action. This example demonstrates how to set a custom retention period of 5 days for the artifact named `my-artifact`: diff --git a/content/code-security/concepts/about-code-quality.md b/content/code-security/concepts/about-code-quality.md index b0eb4649bfc4..39a9178f3dce 100644 --- a/content/code-security/concepts/about-code-quality.md +++ b/content/code-security/concepts/about-code-quality.md @@ -30,6 +30,7 @@ With {% data variables.product.prodname_code_quality_short %}, you can: * Use **repository dashboards** to track reliability and maintainability scores, identify areas needing attention, and prioritize remediation. * Monitor **organization dashboards** to understand the code health of your repositories at a glance and determine which repositories to investigate further. * Set up **rulesets** for pull requests to enforce code quality standards and block changes that do not meet your criteria. +* Upload **code coverage** reports to see test coverage metrics directly on pull requests, helping reviewers identify untested code. * Easily assign remediation work to **{% data variables.copilot.copilot_cloud_agent %}**, if you have a {% data variables.product.prodname_copilot_short %} license. ## Availability and usage costs @@ -63,6 +64,8 @@ In addition, you'll see an AI-powered analysis of all recent pushes to the defau When {% data variables.product.prodname_codeql %} finds rule-based problems on pull requests, you'll see comments from the `{% data variables.code-quality.pr_commenter %}`. Where possible, each comment will include a {% data variables.copilot.copilot_autofix_short %} suggestion on how to fix the problem. See [AUTOTITLE](/code-security/code-quality/tutorials/fix-findings-in-prs). +If you have set up code coverage, the `{% data variables.code-quality.pr_commenter %}` also posts a coverage summary showing the aggregate coverage percentage for the PR branch compared to the default branch. See [AUTOTITLE](/code-security/how-tos/maintain-quality-code/interpret-results#viewing-code-coverage-on-pull-requests). + ### Default branch results {% data variables.product.prodname_code_quality_short %} findings on the default branch are reported on "{% data variables.code-quality.code_quality_ui %}" pages on the **{% data variables.product.prodname_security_and_quality_tab %}** tab for the repository: diff --git a/content/code-security/how-tos/maintain-quality-code/enable-code-quality.md b/content/code-security/how-tos/maintain-quality-code/enable-code-quality.md index 614a8e504680..6a2f5ebc393e 100644 --- a/content/code-security/how-tos/maintain-quality-code/enable-code-quality.md +++ b/content/code-security/how-tos/maintain-quality-code/enable-code-quality.md @@ -42,4 +42,5 @@ category: ## Next steps * **For your repository:** Explore your code quality findings and merge your first fix. See [AUTOTITLE](/code-security/tutorials/improve-code-quality/quickstart). +* **Add code coverage:** Upload test coverage reports to see coverage results directly on pull requests. See [AUTOTITLE](/code-security/how-tos/maintain-quality-code/set-up-code-coverage). * **For your organization:** Understand the code health of your repositories at a glance. See [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/analyze-organization-data/explore-code-quality). diff --git a/content/code-security/how-tos/maintain-quality-code/index.md b/content/code-security/how-tos/maintain-quality-code/index.md index bc9edf9f5fcf..07c85c1f64cd 100644 --- a/content/code-security/how-tos/maintain-quality-code/index.md +++ b/content/code-security/how-tos/maintain-quality-code/index.md @@ -8,6 +8,7 @@ versions: contentType: how-tos children: - /enable-code-quality + - /set-up-code-coverage - /interpret-results - /set-pr-thresholds - /unblock-your-pr diff --git a/content/code-security/how-tos/maintain-quality-code/interpret-results.md b/content/code-security/how-tos/maintain-quality-code/interpret-results.md index 5df01df2d651..bf8c63a586b4 100644 --- a/content/code-security/how-tos/maintain-quality-code/interpret-results.md +++ b/content/code-security/how-tos/maintain-quality-code/interpret-results.md @@ -54,6 +54,18 @@ Code quality results should always be interpreted in the context of your reposit To learn more about the metrics and how the ratings are calculated, see [AUTOTITLE](/code-security/code-quality/reference/metrics-and-ratings). +## Viewing code coverage on pull requests + +After code coverage is configured for your repository, the `{% data variables.code-quality.pr_commenter %}` posts a coverage summary comment on each pull request. The comment includes: + +* **Branch-vs-default-branch comparison:** The aggregate coverage percentage for the pull request branch and the default branch (for example, "65% on pull request branch, 44% on default branch"). +* **Most impacted files:** The 10 files with the largest coverage changes between the default branch and the pull request branch. This list may include files not directly modified in the pull request. New or modified files are ranked above deleted files. Within each group, files are sorted by the absolute change in line coverage weighted by the number of lines in the file, with coverage magnitude and then filename as tiebreakers. +* **Per-file breakdown:** An expandable section listing each file with its coverage percentage and delta value. A positive delta means the file gained coverage on this branch. A negative delta indicates coverage decreased, which may signal untested code paths introduced by the change. + +Use the coverage summary to identify files with low or declining coverage and prioritize review attention on untested changes. + +For more information about how the coverage percentage is calculated, see [AUTOTITLE](/code-security/reference/code-quality/metrics-and-ratings#code-coverage). + ## Next steps * Remediate quality findings in your default branch and improve the maintainability and reliability rating for your repository. See [AUTOTITLE](/code-security/code-quality/tutorials/improve-your-codebase). diff --git a/content/code-security/how-tos/maintain-quality-code/set-up-code-coverage.md b/content/code-security/how-tos/maintain-quality-code/set-up-code-coverage.md new file mode 100644 index 000000000000..d20bdfdb383e --- /dev/null +++ b/content/code-security/how-tos/maintain-quality-code/set-up-code-coverage.md @@ -0,0 +1,129 @@ +--- +title: Setting up code coverage for your repository +shortTitle: Set up code coverage +intro: 'Upload test coverage reports to see coverage results directly on pull requests, helping reviewers identify untested code before merging.' +versions: + feature: code-quality +product: '{% data reusables.gated-features.code-quality-availability %}' +permissions: '{% data reusables.permissions.code-quality-repo-enable %}' +contentType: how-tos +layout: inline +category: + - Improve code quality +--- + +{% data reusables.code-quality.code-quality-preview-note %} + +In the following procedures, you will generate a Cobertura XML coverage report from your test suite, upload it to {% data variables.product.github %}, and view the coverage results on your pull requests. + +## Prerequisites + +* {% data variables.product.prodname_code_quality_short %} is enabled for your repository. +* Your repository has a test suite that runs in {% data variables.product.prodname_actions %}. +* Your test framework can produce a coverage report in **Cobertura XML** format. + +## Step 1: Generate a Cobertura XML coverage report + +Configure your test framework to output a coverage report in the Cobertura XML format. Code coverage works with any programming language that can produce this format. + +1. Identify the coverage tool for your language from the table below. +1. Add the appropriate command or configuration to your CI workflow so that a Cobertura XML file is generated each time your tests run. + +| Language | Framework / Tool | How to generate Cobertura XML | +|----------|-----------------|-------------------------------| +| Python | `pytest` + `pytest-cov` | `pytest --cov=. --cov-report=xml` | +| Java | JaCoCo | Use the `cover2cover.py` script or the JaCoCo-to-Cobertura Gradle/Maven plugin | +| JavaScript/TypeScript | Istanbul / `nyc` | `nyc report --reporter=cobertura` | +| Ruby | SimpleCov | Add `SimpleCov::Formatter::CoberturaFormatter` | +| Go | `go test` + `gocover-cobertura` | `go test -coverprofile=cover.out && gocover-cobertura < cover.out > coverage.xml` | + +> [!TIP] +> If your framework isn't listed above, check its documentation for Cobertura output support. Many tools either support it directly or can convert to Cobertura XML from other formats. + +## Step 2: Upload the coverage report + +After your tests generate a Cobertura XML report, upload it to {% data variables.product.github %} so coverage results appear on pull requests. + +1. Open your repository's CI workflow file (for example, `.github/workflows/ci.yml`). +1. Add the following step after the step that runs your tests and generates the coverage report: + + ```yaml copy + - name: Upload coverage report + if: {% raw %}github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository{% endraw %} + uses: actions/upload-code-coverage@v1 + with: + report: COVERAGE-FILE-PATH.xml + language: LANGUAGE + label: LABEL + ``` + +1. Replace the following values: + * **`COVERAGE-FILE-PATH.xml`**: The path to your Cobertura XML report (for example, `coverage.xml` or `target/site/jacoco/cobertura.xml`). + * **`LANGUAGE`**: The primary language of the code being covered (for example, `Python`, `Java`, `JavaScript`). + * **`LABEL`**: An optional label to identify this coverage report (for example, `code-coverage/pytest`). +1. Commit and push the workflow change. + +### Full workflow example + +This example runs Python tests with `pytest-cov` and uploads the coverage report: + +```yaml annotate copy +# This workflow runs your test suite, generates a Cobertura XML coverage report, and uploads it to {% data variables.product.github %}. Once this workflow is committed, coverage results appear automatically on every pull request. +name: Code Coverage + +# Run on pushes to the default branch (to establish the baseline) and on pull requests (to compare against it). {% data variables.product.prodname_code_quality_short %} compares PR branch coverage to the default branch, so both triggers are needed. +on: + push: + branches: [main] + pull_request: + branches: [main] + +# The `code-quality: write` permission is required to upload coverage data. No other elevated permissions are needed. +permissions: + contents: read + code-quality: write + +jobs: + test: + runs-on: ubuntu-latest + steps: + # Check out the PR head commit (not the merge commit) so coverage line numbers map correctly to the diff. + - uses: {% data reusables.actions.action-checkout %} + with: + ref: {% raw %}${{ github.event.pull_request.head.sha || github.sha }}{% endraw %} + + # Replace this step with whatever language setup your project uses (Node.js, Java, Go, etc.). The upload action works with any language that produces a Cobertura XML report. + - uses: {% data reusables.actions.action-setup-python %} + with: + python-version: "3.x" + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install -r requirements.txt + pip install pytest pytest-cov + + # Adapt this step for your test framework. The key requirement is producing a Cobertura XML file. For other languages, see the framework table earlier in this article. + - name: Run tests with coverage + run: pytest --cov=. --cov-report=xml + + # This step replaces any third-party coverage upload (Codecov, Coveralls, etc.). After this runs, the `{% data variables.code-quality.pr_commenter %}` bot posts a coverage summary directly on the pull request. + - name: Upload coverage report + if: {% raw %}github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository{% endraw %} + uses: actions/upload-code-coverage@v1 + with: + report: coverage.xml + language: Python + label: code-coverage/pytest +``` + +## Step 3: View coverage results on pull requests + +1. Open a pull request (or push to an existing one) that triggers the workflow you configured. +1. After the workflow completes, look for a comment from `{% data variables.code-quality.pr_commenter %}` on the pull request. The comment includes: + * The aggregate coverage percentage for the pull request branch compared to the default branch. + * A per-file breakdown showing which files gained or lost coverage. + +## Next steps + +* **Interpret results:** Understand coverage metrics and per-file breakdowns on your pull requests. See [AUTOTITLE](/code-security/how-tos/maintain-quality-code/interpret-results). diff --git a/content/code-security/reference/code-quality/metrics-and-ratings.md b/content/code-security/reference/code-quality/metrics-and-ratings.md index 3c0937a013b2..1b57b1580859 100644 --- a/content/code-security/reference/code-quality/metrics-and-ratings.md +++ b/content/code-security/reference/code-quality/metrics-and-ratings.md @@ -47,6 +47,22 @@ These ratings are used to summarize the overall reliability and maintainability | **Fair** | Codebase has moderate-severity issues that may impact quality, but are not critical. | ≥1 "Warning" level finding | | **Needs Improvement**| Codebase has high-severity issues, including bugs or major maintainability risks. | ≥1 "Error" level finding | +## Code coverage + +Code coverage measures what percentage of your source code is executed when your test suite runs. {% data variables.product.prodname_code_quality_short %} displays a coverage percentage on pull requests after you upload a Cobertura XML coverage report. + +### How coverage is calculated + +The coverage percentage represents the number of lines covered by tests divided by the total number of lines, expressed as a percentage. {% data variables.product.prodname_code_quality_short %} stores the latest upload for each branch (including the default branch) and compares the PR branch coverage to the default branch coverage. + +For example, if your default branch has 44% coverage and your PR branch has 65% coverage, the PR gained 21 percentage points of coverage. + +### Per-file delta + +The per-file breakdown on pull requests shows how coverage changed for each modified file. A positive delta means the file gained coverage on the PR branch compared to the default branch. + +To set up code coverage for your repository, see [AUTOTITLE](/code-security/how-tos/maintain-quality-code/set-up-code-coverage). + ## Further reading * [AUTOTITLE](/code-security/code-quality/concepts/about-code-quality) diff --git a/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md b/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md index 7b6b2392b265..ca6979a7351b 100644 --- a/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md +++ b/content/copilot/concepts/agents/cloud-agent/about-cloud-agent.md @@ -148,6 +148,7 @@ You can customize {% data variables.copilot.copilot_cloud_agent %} in a number o * **{% data variables.product.prodname_copilot_short %} can only make changes in the repository specified when you start a task**. {% data variables.product.prodname_copilot_short %} cannot make changes across multiple repositories in one run. * **By default, {% data variables.product.prodname_copilot_short %} can only access context in the repository specified when you start a task**. The {% data variables.product.prodname_copilot_short %} MCP server is configured by default to allow {% data variables.product.prodname_copilot_short %} to access context (for example issues and historic pull requests) in the repository where it is working. You can, however, configure broader access. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/cloud-agent/extend-cloud-agent-with-mcp). * **{% data variables.product.prodname_copilot_short %} can only work on one branch at a time** and can open exactly one pull request to address each task it is assigned. +* **Each {% data variables.copilot.copilot_cloud_agent %} session has a maximum execution time of 59 minutes**. This is a hard limit that cannot be extended or bypassed. If a task exceeds this limit, the session will time out and stop. For complex tasks that may require more time, consider breaking the work into smaller, more focused tasks. You can configure a shorter timeout using the `timeout-minutes` setting in your `copilot-setup-steps.yml` file. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/cloud-agent/customize-the-agent-environment). ### Limitations in {% data variables.copilot.copilot_cloud_agent %}'s compatibility with other features diff --git a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md index 45ca9a98dd65..bf8e32c71df4 100644 --- a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md +++ b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md @@ -156,8 +156,10 @@ Sessions already open in another window float to the top in all non-relevance so | Ctrl+K | Delete from cursor to end of the line. If the cursor is at the end of the line, delete the line break. | | Ctrl+U | Delete from cursor to beginning of the line. | | Ctrl+W | Delete the previous word. | -| Home | Move to the start of the text. | -| End | Move to the end of the text. | +| Home | Move to the start of the current visual line. | +| End | Move to the end of the current visual line. | +| Ctrl+Home | Move to the start of the text. | +| Ctrl+End | Move to the end of the text. | | Alt+←/→ (Windows/Linux)
Option+←/→ (Mac) | Move the cursor by a word. | | ↑/↓ | Navigate the command history. | | Tab / Ctrl+Y | Accept the current inline completion suggestion. | @@ -174,7 +176,9 @@ Sessions already open in another window float to the top in all non-relevance so | `/chronicle ` | Session history tools and insights. {% data reusables.copilot.experimental %} | | `/clear [PROMPT]`, `/new [PROMPT]`, `/reset [PROMPT]` | Start a new conversation. | | `/clikit [COMPONENT]` | Preview CLI business components (for example, quota info). | -| `/compact` | Summarize the conversation history to reduce context window usage. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/context-management#compaction). | +| `/collect-debug-logs [file\|gist] [PATH]` | Collect debug logs to an archive file or {% data variables.product.github %} gist. | +| `/diagnose [PROMPT]` | Analyze the current session log and optionally prompt the agent with a question about diagnostics. | +| `/compact [FOCUS-INSTRUCTIONS]` | Summarize the conversation history to reduce context window usage. Optionally provide focus instructions to steer the summary—for example, `/compact focus on the auth module`. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/context-management#compaction). | | `/context` | Show the context window token usage and visualization. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/context-management#checking-your-context-usage). | | `/copy` | Copy the last response to the clipboard. | | `/cwd`, `/cd [PATH]` | Change the working directory or display the current directory. | @@ -183,6 +187,7 @@ Sessions already open in another window float to the top in all non-relevance so | `/downgrade ` | Download and restart into a specific CLI version. Available for team accounts. | | `/env` | Show loaded environment details (instructions, MCP servers, skills, agents, plugins, LSPs, extensions). | | `/exit`, `/quit` | Exit the CLI. | +| `/extensions [manage\|mode]`, `/extension` | Manage CLI extensions. | | `/experimental [on\|off\|show]` | Toggle, set, or show experimental features. | | `/feedback`, `/bug` | Provide feedback about the CLI. | | `/fleet [PROMPT]` | Enable parallel subagent execution of parts of a task. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/fleet). | @@ -197,6 +202,7 @@ Sessions already open in another window float to the top in all non-relevance so | `/lsp [show\|test\|reload\|help] [SERVER-NAME]` | Manage the language server configuration. | | `/mcp [show\|add\|edit\|delete\|disable\|enable\|auth\|reload] [SERVER-NAME]` | Manage the MCP server configuration. See [AUTOTITLE](/copilot/how-tos/copilot-cli/customize-copilot/add-mcp-servers#managing-mcp-servers). | | `/model`, `/models [MODEL]` | Select the AI model you want to use. | +| `/permissions [show\|reset]` | View or clear in-memory tool and path approvals for the current session. | | `/plan [PROMPT]` | Create an implementation plan before coding. | | `/plugin [marketplace\|install\|uninstall\|update\|list] [ARGS...]` | Manage plugins and plugin marketplaces. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/about-cli-plugins). | | `/pr [view\|create\|fix\|auto]` | Manage pull requests for the current branch. See [AUTOTITLE](/copilot/how-tos/copilot-cli/use-copilot-cli/manage-pull-requests). | @@ -207,6 +213,7 @@ Sessions already open in another window float to the top in all non-relevance so | `/restart` | Restart the CLI, preserving the current session. | | `/resume [SESSION-ID]`, `/continue [SESSION-ID]` | Switch to a different session by choosing from a list (optionally specify a session ID). | | `/review [PROMPT]` | Run the code review agent to analyze changes. See [AUTOTITLE](/copilot/how-tos/copilot-cli/use-copilot-cli/agentic-code-review). | +| `/sandbox [enable\|disable]` | Configure shell command sandboxing. | | `/search [QUERY]`, `/find [QUERY]` | Search the conversation timeline. {% data reusables.copilot.experimental %} | | `/session [info\|checkpoints [n]\|files\|plan\|rename [NAME]\|cleanup\|prune\|delete [ID]\|delete-all]`, `/sessions [info\|checkpoints [n]\|files\|plan\|rename [NAME]\|cleanup\|prune\|delete [ID]\|delete-all]` | Show session information and manage sessions. Subcommands: `info`, `checkpoints`, `files`, `plan`, `rename`, `cleanup`, `prune`, `delete`, `delete-all`. | | `/share [file\|html\|gist] [session\|research] [PATH]`, `/export [file\|html\|gist] [session\|research] [PATH]` | Share the session to a Markdown file, interactive HTML file, or {% data variables.product.github %} gist. | @@ -215,6 +222,7 @@ Sessions already open in another window float to the top in all non-relevance so | `/tasks` | View and manage tasks (subagents and shell commands). | | `/terminal-setup` | Configure the terminal for multiline input support (Shift+Enter and Ctrl+Enter). | | `/theme [default\|dim\|high-contrast\|colorblind]` | View or set the color mode. | +| `/tuikit [colors\|icons\|select\|tabbar]` | Preview TUIkit design-system components and color tokens. | | `/undo`, `/rewind` | Rewind the last turn and revert file changes. | | `/update`, `/upgrade` | Update the CLI to the latest version. | | `/usage` | Display session usage metrics and statistics. | @@ -243,6 +251,7 @@ For a complete list of available slash commands enter `/help` in the CLI's inter | `--banner`, `--no-banner` | Show or hide the startup banner. | | `--bash-env` | Enable `BASH_ENV` support for bash shells. | | `--connect[=SESSION-ID]` | Connect directly to a remote session (optionally specify a session ID or task ID). Conflicts with `--resume` and `--continue`. | +| `--config-dir=DIRECTORY` | This option for setting the configuration directory is deprecated. Use the `COPILOT_HOME` environment variable instead. | | `--continue` | Resume the most recent session in the current working directory, falling back to the globally most recent session. | | `--deny-tool=TOOL ...` | Tools the CLI does not have permission to use. Will not prompt for permission. For multiple tools, use a quoted, comma-separated list. | | `--deny-url=URL ...` | Deny access to specific URLs or domains, takes precedence over `--allow-url`. For multiple URLs, use a quoted, comma-separated list. | @@ -283,7 +292,7 @@ For a complete list of available slash commands enter `/help` in the CLI's inter | `--secret-env-vars=VAR ...` | Redact an environment variable from shell and MCP server environments (can be used multiple times). For multiple variables, use a quoted, comma-separated list. The values in the `GITHUB_TOKEN` and `COPILOT_GITHUB_TOKEN` environment variables are redacted from output by default. | | `--share=PATH` | Share a session to a Markdown file after completion of a programmatic session (default path: `./copilot-session-.md`). | | `--share-gist` | Share a session to a secret {% data variables.product.github %} gist after completion of a programmatic session. | -| `--stream=MODE` | Enable or disable streaming mode (mode choices: `on` or `off`). | +| `--stream=MODE` | Enable or disable streaming mode, which displays {% data variables.product.prodname_copilot_short %}'s response progressively as it is generated rather than waiting for the full response to arrive (mode choices: `on` or `off`, default: `on`). | `-v`, `--version` | Show version information. | | `--yolo` | Enable all permissions (equivalent to `--allow-all`). | diff --git a/content/copilot/reference/copilot-cli-reference/cli-plugin-reference.md b/content/copilot/reference/copilot-cli-reference/cli-plugin-reference.md index 452fdaec0aef..65ef95a77671 100644 --- a/content/copilot/reference/copilot-cli-reference/cli-plugin-reference.md +++ b/content/copilot/reference/copilot-cli-reference/cli-plugin-reference.md @@ -25,7 +25,9 @@ You can use the following commands in the terminal to manage plugins for {% data | `copilot plugin install SPECIFICATION` | Install a plugin. See [Plugin specification for `install` command](#plugin-specification-for-install-command) below. | | `copilot plugin uninstall NAME` | Remove a plugin | | `copilot plugin list` | List installed plugins | -| `copilot plugin update NAME` | Update a plugin | +| `copilot plugin update NAME` | Update a named plugin. Use `--all` to update all installed plugins at once. | +| `copilot plugin enable NAME` | Enable a previously disabled plugin | +| `copilot plugin disable NAME` | Disable a plugin without uninstalling it | | `copilot plugin marketplace add SPECIFICATION` | Register a marketplace | | `copilot plugin marketplace list` | List registered marketplaces | | `copilot plugin marketplace browse NAME` | Browse marketplace plugins | @@ -149,6 +151,7 @@ For more information, see [AUTOTITLE](/copilot/how-tos/copilot-cli/customize-cop | Hooks configuration | `hooks.json` or `hooks/hooks.json` | | MCP configuration | `.mcp.json`, `.github/mcp.json` | | LSP configuration | `lsp.json` or `.github/lsp.json` | +| Plugin data | `${COPILOT_PLUGIN_DATA}` (also available as `${CLAUDE_PLUGIN_DATA}`). Points to a persistent, writable directory unique to each installed plugin. Use this for plugin-specific runtime data instead of paths inside the installed-plugins cache directory. | ## Loading order and precedence diff --git a/content/copilot/reference/hooks-reference.md b/content/copilot/reference/hooks-reference.md index 06f2a31bc3f5..d3a29182cf61 100644 --- a/content/copilot/reference/hooks-reference.md +++ b/content/copilot/reference/hooks-reference.md @@ -88,19 +88,21 @@ Command hooks run shell scripts and are supported on all hook types. | Field | Type | Required | Description | |-------|------|----------|-------------| | `bash` | string | One of `bash`, `powershell`, or `command` | Shell command for Unix. | -| `command` | string | One of `bash`, `powershell`, or `command` | Cross-platform fallback used when neither `bash` nor `powershell` is set for the current platform. | +| `command` | string | One of `bash`, `powershell`, or `command` | Cross-platform fallback. Copied to both `bash` and `powershell` when those fields are absent; explicit `bash` or `powershell` entries take precedence on their respective platforms. | | `cwd` | string | No | Working directory for the command (relative to repository root or absolute). | | `env` | object | No | Environment variables to set (supports variable expansion). | | `powershell` | string | One of `bash`, `powershell`, or `command` | Shell command for Windows. | +| `timeout` | number | No | Alias for `timeoutSec`, in seconds. Used only when `timeoutSec` is absent; `timeoutSec` takes precedence when both are present. | | `timeoutSec` | number | No | Timeout in seconds. Default: `30`. | -| `type` | `"command"` | Yes | Must be `"command"`. | +| `type` | `"command"` | No | Hook type. Defaults to `"command"` when omitted. | ### HTTP hooks HTTP hooks send the input payload as a JSON `POST` to a URL. > [!NOTE] -> **Cloud agent only.** Outbound network from the sandbox is restricted by the cloud agent firewall, so `url` must target an allow-listed host. +> * By default, only `https://` URLs are allowed. Non-TLS `http://` requests are rejected, except for `http://localhost`, `http://127.*`, and `http://[::1]` when `COPILOT_HOOK_ALLOW_LOCALHOST=1` is set. +> * **Cloud agent only.** Outbound network from the sandbox is restricted by the cloud agent firewall, so `url` must target an allow-listed host. ```json { @@ -123,6 +125,7 @@ HTTP hooks send the input payload as a JSON `POST` to a URL. |-------|------|----------|-------------| | `allowedEnvVars` | string[] | No | Environment variable names that may be expanded inside `headers` values. When set, `url` must use `https://`. | | `headers` | object | No | Request headers to include. | +| `timeout` | number | No | Alias for `timeoutSec`, in seconds. Used only when `timeoutSec` is absent; `timeoutSec` takes precedence when both are present. | | `timeoutSec` | number | No | Timeout in seconds. Default: `30`. | | `type` | `"http"` | Yes | Must be `"http"`. | | `url` | string | Yes | Target URL. Must use `http:` or `https:`. For `preToolUse` and `permissionRequest`, must use `https://` because the response can grant tool permissions. | @@ -382,6 +385,9 @@ When configured with the PascalCase event name `PreToolUse`, the payload uses sn ### `subagentStart` +> [!NOTE] +> The built-in `general-purpose` agent does not emit `subagentStart` or `subagentStop` events. + **Input:** ```typescript diff --git a/data/reusables/support/scope-of-support.md b/data/reusables/support/scope-of-support.md index 6b52eca7d4a2..f5523f663b64 100644 --- a/data/reusables/support/scope-of-support.md +++ b/data/reusables/support/scope-of-support.md @@ -17,7 +17,7 @@ If your support request is outside of the scope of what our team can help you wi * Preview features. {% data variables.release-phases.public_preview_caps %}, {% data variables.release-phases.private_preview %}, and {% data variables.release-phases.technical_preview %} features are out of {% data variables.contact.github_support %}'s scope. * {% data variables.product.prodname_copilot %} suggestions * {% data variables.product.prodname_copilot %} consumption questions. {% data variables.contact.github_support %} does not audit or break down {% data variables.product.prodname_copilot_short %} usage consumption. Support can explain the billing model and point you to available usage-reporting documentation, but cannot determine why usage appears high or why included usage was exhausted sooner than expected. -* Metered billing explanations. {% data variables.contact.github_support %} does not interpret usage reporting or spending trends for metered {% data variables.product.github %} billing products, nor provide recommendations based on that data. For more information, see [AUTOTITLE](/billing/concepts/billing-cycles). +* Metered billing explanations. {% data variables.contact.github_support %} does not interpret usage reporting or spending trends for metered {% data variables.product.github %} billing products, nor provide recommendations based on that data.{% ifversion enhanced-billing-platform %} For more information, see [AUTOTITLE](/billing/concepts/billing-cycles).{% endif %} {% data variables.product.prodname_copilot %} provides AI-powered code suggestions and responses. As outlined in our legal terms, you retain full responsibility for your code, including any suggestions you choose to incorporate. The quality, accuracy, relevance, or functionality of {% data variables.product.prodname_copilot_short %}’s responses may not always meet your expectations, and mistakes may occur. It is your decision whether to use {% data variables.product.prodname_copilot_short %}’s suggestions, and GitHub strongly recommends implementing reasonable policies and practices to prevent the use of any suggestion in a way that could violate the rights of others. This includes, but is not limited to, using the filtering features available in {% data variables.product.prodname_copilot_short %}. diff --git a/data/ui.yml b/data/ui.yml index dbb12deae55a..7d6c90dbe7a7 100644 --- a/data/ui.yml +++ b/data/ui.yml @@ -25,6 +25,9 @@ picker: product_picker_default_text: All products version_picker_default_text: Choose a version +code_tabs: + aria_label: Code languages + release_notes: banner_text: GitHub began rolling these changes out to enterprises on diff --git a/src/audit-logs/data/fpt/organization.json b/src/audit-logs/data/fpt/organization.json index 4a593f3780f4..e98cc3533434 100644 --- a/src/audit-logs/data/fpt/organization.json +++ b/src/audit-logs/data/fpt/organization.json @@ -8142,70 +8142,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.code_security_metered_usage_lock", "description": "Enablement for Code Security features on new repositories has been locked for this organization.", diff --git a/src/audit-logs/data/ghec/enterprise.json b/src/audit-logs/data/ghec/enterprise.json index daf69c428e74..18093e05f215 100644 --- a/src/audit-logs/data/ghec/enterprise.json +++ b/src/audit-logs/data/ghec/enterprise.json @@ -14069,70 +14069,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghec/organization.json b/src/audit-logs/data/ghec/organization.json index 4a593f3780f4..e98cc3533434 100644 --- a/src/audit-logs/data/ghec/organization.json +++ b/src/audit-logs/data/ghec/organization.json @@ -8142,70 +8142,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.code_security_metered_usage_lock", "description": "Enablement for Code Security features on new repositories has been locked for this organization.", diff --git a/src/audit-logs/data/ghes-3.14/enterprise.json b/src/audit-logs/data/ghes-3.14/enterprise.json deleted file mode 100644 index ce1e81f99085..000000000000 --- a/src/audit-logs/data/ghes-3.14/enterprise.json +++ /dev/null @@ -1,24512 +0,0 @@ -[ - { - "action": "account.billing_date_change", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "account.plan_change", - "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "How GitHub billing works" - }, - { - "action": "account_recovery_token.confirm", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "account_recovery_token.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "account_recovery_token.recover", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "actions_cache.delete", - "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "actions_cache_id", - "actions_cache_key", - "actions_cache_version", - "actions_cache_scope", - "created_at", - "operation_type" - ] - }, - { - "action": "api.request", - "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "request_method", - "query_string", - "request_body", - "status_code", - "url_path", - "public_repo", - "created_at", - "operation_type", - "route", - "rate_limit_remaining", - "actor_is_bot" - ], - "docs_reference_titles": "Streaming the audit log for your enterprise" - }, - { - "action": "artifact.destroy", - "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "audit_log_streaming.check", - "description": "A manual check of the endpoint configured for audit log streaming was performed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "audit_log_stream_result", - "created_at", - "operation_type", - "audit_log_stream_sink_details" - ] - }, - { - "action": "audit_log_streaming.create", - "description": "An endpoint was added for audit log streaming.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "audit_log_stream_sink", - "created_at", - "operation_type", - "audit_log_stream_id" - ] - }, - { - "action": "audit_log_streaming.destroy", - "description": "An audit log streaming endpoint was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "audit_log_stream_id", - "audit_log_stream_sink_details" - ] - }, - { - "action": "audit_log_streaming.update", - "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "audit_log_stream_enabled", - "audit_log_stream_sink", - "created_at", - "operation_type", - "new_s3_bucket", - "old_s3_bucket", - "secrets_updated", - "new_s3_arn_role", - "old_s3_arn_role", - "new_azure_blob_container", - "old_azure_blob_container", - "new_event_hub_instance", - "old_event_hub_instance", - "new_splunk_domain", - "old_splunk_domain", - "ssl_verify", - "old_gc_bucket" - ] - }, - { - "action": "billing.change_billing_type", - "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing your payment and billing information" - }, - { - "action": "billing.change_email", - "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "email" - ], - "docs_reference_titles": "Managing your payment and billing information" - }, - { - "action": "billing.lock", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "billing.unlock", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "billing.update_bill_cycle_day", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business.add_admin", - "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Inviting people to manage your enterprise" - }, - { - "action": "business.add_organization", - "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "created_at", - "organization_upgrade" - ] - }, - { - "action": "business_advanced_security.disabled", - "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_advanced_security.disabled_for_new_repos", - "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_advanced_security.disabled_for_new_user_namespace_repos", - "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_advanced_security.enabled", - "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_advanced_security.enabled_for_new_repos", - "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_advanced_security.enabled_for_new_user_namespace_repos", - "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business.advanced_security_policy_update", - "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "new_policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "business.advanced_security_repo_admin_enablement_policy_update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "new_policy", - "created_at", - "operation_type" - ] - }, - { - "action": "business_advanced_security.user_namespace_repos_disabled", - "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_advanced_security.user_namespace_repos_enabled", - "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business.clear_actions_settings", - "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.clear_default_repository_permission", - "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "business.clear_members_can_create_repos", - "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "visibility", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "business.code_scanning_autofix_policy_update", - "description": "The policy for Code scanning autofix was updated for an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "new_policy", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "business.create", - "description": "An enterprise was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ] - }, - { - "action": "business_dependabot_alerts_new_repos.disable", - "description": "Dependabot alerts were disabled for new repositories in your enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business_dependabot_alerts_new_repos.enable", - "description": "Dependabot alerts were enabled for new repositories in your enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "new_policy", - "created_at", - "operation_type" - ] - }, - { - "action": "business.disable_open_scim", - "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business.disable_source_ip_disclosure", - "description": "Display of IP addresses within audit log events for the enterprise was disabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Displaying IP addresses in the audit log for your enterprise" - }, - { - "action": "business.disable_two_factor_requirement", - "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "name" - ] - }, - { - "action": "business.enable_open_scim", - "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business.enable_source_ip_disclosure", - "description": "Display of IP addresses within audit log events for the enterprise was enabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Displaying IP addresses in the audit log for your enterprise" - }, - { - "action": "business.enable_two_factor_requirement", - "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "name" - ] - }, - { - "action": "business.members_can_update_protected_branches.clear", - "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "operation_type" - ] - }, - { - "action": "business.members_can_update_protected_branches.disable", - "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ] - }, - { - "action": "business.members_can_update_protected_branches.enable", - "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ] - }, - { - "action": "business.remove_admin", - "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "name" - ], - "docs_reference_titles": "Inviting people to manage your enterprise" - }, - { - "action": "business.remove_organization", - "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "name" - ] - }, - { - "action": "business.rename_slug", - "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ] - }, - { - "action": "business.revoke_sso_session", - "description": "The SAML single sign-on session for a member in an enterprise was revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "created_at" - ] - }, - { - "action": "business_secret_scanning_automatic_validity_checks.disabled", - "description": "Automatic partner validation checks have been disabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_automatic_validity_checks.enabled", - "description": "Automatic partner validation checks have been enabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_custom_pattern.create", - "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "business_secret_scanning_custom_pattern.delete", - "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business_secret_scanning_custom_pattern.publish", - "description": "An enterprise-level custom pattern was published for secret scanning.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business_secret_scanning_custom_pattern_push_protection.disabled", - "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "business_secret_scanning_custom_pattern_push_protection.enabled", - "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "business_secret_scanning_custom_pattern.update", - "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business_secret_scanning.disable", - "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning.disabled_for_new_repos", - "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning.enable", - "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning.enabled_for_new_repos", - "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_non_provider_patterns.disabled", - "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "business_secret_scanning_non_provider_patterns.enabled", - "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "business_secret_scanning_push_protection_custom_message.disable", - "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_push_protection_custom_message.enable", - "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_push_protection_custom_message.update", - "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_push_protection.disable", - "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_push_protection.disabled_for_new_repos", - "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_push_protection.enable", - "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business_secret_scanning_push_protection.enabled_for_new_repos", - "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise" - }, - { - "action": "business.secret_scanning_repo_admin_settings_policy_update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "new_policy", - "created_at", - "operation_type" - ] - }, - { - "action": "business.set_actions_fork_pr_approvals_policy", - "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_fork_pr_workflows_policy", - "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.sso_response", - "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "issuer", - "name", - "created_at", - "operation_type" - ] - }, - { - "action": "business.update_actions_settings", - "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "updated_github_owned_allowed", - "updated_verified_allowed", - "updated_patterns", - "new_policy", - "old_policy", - "updated_access_policy" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.update_default_repository_permission", - "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "permission", - "created_at", - "name", - "old_permission" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "business.update_member_repository_creation_permission", - "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "operation_type", - "permission", - "visibility" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "business.update_member_repository_invitation_permission", - "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "permission", - "name" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "checks.auto_trigger_disabled", - "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" - }, - { - "action": "checks.auto_trigger_enabled", - "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" - }, - { - "action": "checks.delete_logs", - "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "codespaces.allow_permissions", - "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "origin_repository", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.connect", - "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot", - "machine_type", - "devcontainer_path" - ] - }, - { - "action": "codespaces.create", - "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at", - "actor_is_bot", - "machine_type", - "devcontainer_path" - ], - "docs_reference_titles": "Creating a codespace for a repository" - }, - { - "action": "codespaces.destroy", - "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Deleting a codespace" - }, - { - "action": "codespaces.export_environment", - "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "owner", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "codespaces.restore", - "description": "A codespace was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.start_environment", - "description": "A codespace was started.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "pull_request_id", - "machine_type", - "devcontainer_path", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.suspend_environment", - "description": "A codespace was stopped.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "codespaces.trusted_repositories_access_update", - "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "copilot.cfb_seat_added", - "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_created", - "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "What is GitHub Copilot?" - }, - { - "action": "copilot.cfb_seat_assignment_refreshed", - "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_reused", - "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_unassigned", - "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_cancelled", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "seat_assignment" - ] - }, - { - "action": "copilot.cfb_seat_cancelled_by_staff", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_property_definition.create", - "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "property_name", - "created_at", - "operation_type", - "value_type", - "required", - "default_value", - "definition_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_definition.destroy", - "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "property_name", - "created_at", - "operation_type", - "value_type", - "required", - "default_value", - "definition_id", - "allowed_values" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_definition.update", - "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "property_name", - "created_at", - "operation_type", - "value_type", - "required", - "default_value", - "old_allowed_values", - "allowed_values", - "definition_id", - "old_required", - "old_default_value", - "old_value_type", - "old_values_editable_by", - "values_editable_by" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_value.create", - "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "definition_id", - "property_name", - "value", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_value.destroy", - "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_value.update", - "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "definition_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "dependabot_alerts.disable", - "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" - }, - { - "action": "dependabot_alerts.enable", - "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" - }, - { - "action": "dependabot_alerts_new_repos.disable", - "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_alerts_new_repos.enable", - "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_repository_access.repositories_updated", - "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "dependabot_security_updates.disable", - "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates.enable", - "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "dependabot_security_updates_new_repos.disable", - "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates_new_repos.enable", - "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "dependency_graph.disable", - "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependency_graph.enable", - "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "dependency_graph_new_repos.disable", - "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependency_graph_new_repos.enable", - "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "discussion_post.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "number", - "title", - "operation_type" - ] - }, - { - "action": "discussion_post_reply.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "number", - "created_at" - ] - }, - { - "action": "discussion_post_reply.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "number", - "team", - "created_at" - ] - }, - { - "action": "discussion_post.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "title", - "operation_type", - "team", - "number" - ] - }, - { - "action": "enterprise_announcement.create", - "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "message", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Customizing user messages for your enterprise" - }, - { - "action": "enterprise_announcement.destroy", - "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Customizing user messages for your enterprise" - }, - { - "action": "enterprise_announcement.update", - "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "message", - "old_message", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Customizing user messages for your enterprise" - }, - { - "action": "enterprise.configure_self_hosted_jit_runner", - "description": "A new just-in-time GitHub Actions self-hosted runner was configured", - "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise" - }, - { - "action": "enterprise_domain.approve", - "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "domain_name", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Verifying or approving a domain for your enterprise" - }, - { - "action": "enterprise_domain.create", - "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "owner_type", - "domain_name", - "owner", - "operation_type" - ], - "docs_reference_titles": "Verifying or approving a domain for your enterprise" - }, - { - "action": "enterprise_domain.destroy", - "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "owner_type", - "domain_name", - "owner", - "operation_type" - ], - "docs_reference_titles": "Verifying or approving a domain for your enterprise" - }, - { - "action": "enterprise_domain.verify", - "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "domain_name", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Verifying or approving a domain for your enterprise" - }, - { - "action": "enterprise.register_self_hosted_runner", - "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "enterprise.remove_self_hosted_runner", - "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Removing self-hosted runners" - }, - { - "action": "enterprise.runner_group_created", - "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at", - "runner_group_restricted_to_workflows" - ], - "docs_reference_titles": "Removing self-hosted runners" - }, - { - "action": "enterprise.runner_group_removed", - "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "enterprise.runner_group_runner_removed", - "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "runner_group_id", - "runner_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" - }, - { - "action": "enterprise.runner_group_runners_added", - "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "enterprise.runner_group_runners_updated", - "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" - }, - { - "action": "enterprise.runner_group_updated", - "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "runner_group_name", - "runner_group_allow_public", - "operation_type", - "created_at", - "runner_group_restricted_to_workflows", - "runner_group_selected_workflow_refs", - "network_configuration_id" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "enterprise.self_hosted_runner_offline", - "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "enterprise.self_hosted_runner_online", - "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "enterprise.self_hosted_runner_updated", - "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "source_version", - "target_version", - "runner_group_id", - "runner_group_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Self-hosted runners" - }, - { - "action": "enterprise_team.add_member", - "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enterprise_team_id", - "enterprise_team", - "created_at", - "operation_type" - ] - }, - { - "action": "enterprise_team.copilot_assignment", - "description": "A license for GitHub Copilot was assigned to an enterprise team.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enterprise_team_id", - "enterprise_team", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "enterprise_team.copilot_unassignment", - "description": "A license for GitHub Copilot was unassigned from an enterprise team.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enterprise_team_id", - "enterprise_team", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "enterprise_team.create", - "description": "A new enterprise team was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enterprise_team_id", - "enterprise_team", - "created_at", - "operation_type" - ] - }, - { - "action": "enterprise_team.destroy", - "description": "An enterprise team was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enterprise_team_id", - "enterprise_team", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "enterprise_team.remove_member", - "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enterprise_team_id", - "enterprise_team", - "created_at", - "operation_type" - ] - }, - { - "action": "enterprise_team.rename", - "description": "The name of an enterprise team was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "enterprise_team_id", - "enterprise_team", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "environment.add_protection_rule", - "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "environment.create_actions_secret", - "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create_actions_variable", - "description": "A variable was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "environment_name", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.delete", - "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.remove_actions_secret", - "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.remove_actions_variable", - "description": "A variable was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.remove_protection_rule", - "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.update_actions_secret", - "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.update_actions_variable", - "description": "A variable was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.update_protection_rule", - "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "new_value", - "approvers_was", - "approvers", - "can_admins_bypass", - "prevent_self_review" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "external_group.add_member", - "description": "A user was added to an external group.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "external_group", - "external_group_id", - "created_at", - "operation_type", - "scim_group_id" - ] - }, - { - "action": "external_group.delete", - "description": "An external group was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at", - "scim_group_id" - ] - }, - { - "action": "external_group.link", - "description": "An external group was linked to a GitHub team.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "external_group_id", - "operation_type", - "created_at", - "external_group", - "scim_group_id" - ] - }, - { - "action": "external_group.provision", - "description": "An external group was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "external_group.remove_member", - "description": "A user was removed from an external group.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "external_group", - "external_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "external_group.scim_api_failure", - "description": "Failed external group SCIM API request.", - "docs_reference_links": "/rest/scim/scim", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "request_method", - "query_string", - "api_request_body", - "route", - "status_code", - "url_path", - "scim_group_id", - "message", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "REST API endpoints for SCIM" - }, - { - "action": "external_group.scim_api_success", - "description": "Successful external group SCIM API request. Excludes GET API requests.", - "docs_reference_links": "/rest/scim/scim", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "request_method", - "query_string", - "api_request_body", - "route", - "status_code", - "url_path", - "scim_group_id", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "REST API endpoints for SCIM" - }, - { - "action": "external_group.unlink", - "description": "An external group was unlinked to a GitHub team.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "external_group_id", - "operation_type", - "created_at", - "external_group" - ] - }, - { - "action": "external_group.update", - "description": "An external group was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at", - "scim_group_id" - ] - }, - { - "action": "external_group.update_display_name", - "description": "An external group's display name was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "external_group_id", - "external_group", - "created_at", - "operation_type", - "scim_group_id" - ] - }, - { - "action": "external_identity.deprovision", - "description": "An external identity was deprovisioned, suspending the linked GitHub user.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "external_identity.provision", - "description": "An external identity was created and linked to a GitHub user.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "scim_user_id" - ] - }, - { - "action": "external_identity.scim_api_failure", - "description": "Failed external identity SCIM API request.", - "docs_reference_links": "/rest/scim/scim", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "request_method", - "query_string", - "api_request_body", - "route", - "status_code", - "url_path", - "scim_user_id", - "message", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "REST API endpoints for SCIM" - }, - { - "action": "external_identity.scim_api_success", - "description": "Successful external identity SCIM API request. Excludes GET API requests.", - "docs_reference_links": "/rest/scim/scim", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "request_method", - "query_string", - "api_request_body", - "route", - "status_code", - "url_path", - "scim_user_id", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "REST API endpoints for SCIM" - }, - { - "action": "external_identity.update", - "description": "An external identity was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "scim_user_id" - ] - }, - { - "action": "gist.create", - "description": "A gist was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "gist_id", - "created_at", - "operation_type", - "visibility" - ] - }, - { - "action": "gist.destroy", - "description": "A gist was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "gist_id", - "visibility", - "created_at", - "operation_type" - ] - }, - { - "action": "gist.visibility_change", - "description": "The visibility of a gist was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "gist_id", - "visibility", - "created_at" - ] - }, - { - "action": "git.clone", - "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "transport_protocol", - "repository_public", - "transport_protocol_name" - ] - }, - { - "action": "git.fetch", - "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "transport_protocol", - "repository_public", - "transport_protocol_name" - ] - }, - { - "action": "git.push", - "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "transport_protocol", - "repository_public", - "transport_protocol_name" - ] - }, - { - "action": "git_signing_ssh_public_key.create", - "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "title", - "key", - "fingerprint", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" - }, - { - "action": "git_signing_ssh_public_key.delete", - "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "title", - "key", - "fingerprint", - "explanation", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" - }, - { - "action": "github_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "github_hosted_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "github_hosted_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "gpg_key.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "gpg_key.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "hook.active_changed", - "description": "A hook's active status was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "events", - "active", - "active_was", - "hook_id", - "operation_type" - ] - }, - { - "action": "hook.config_changed", - "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "hook_id", - "created_at", - "oauth_application_id", - "events" - ] - }, - { - "action": "hook.create", - "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "hook_id", - "events", - "operation_type", - "name", - "created_at" - ], - "docs_reference_titles": "About webhooks" - }, - { - "action": "hook.destroy", - "description": "A hook was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "events", - "created_at", - "name", - "operation_type", - "oauth_application_id", - "hook_id" - ] - }, - { - "action": "hook.events_changed", - "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "events", - "operation_type", - "name", - "events_were", - "created_at", - "hook_id", - "oauth_application_id" - ] - }, - { - "action": "integration.create", - "description": "A GitHub App was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "integration", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.destroy", - "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "integration.generate_client_secret", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration_installation.create", - "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "repository_selection", - "created_at", - "integration", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" - }, - { - "action": "integration_installation.destroy", - "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "repository_selection", - "integration", - "operation_type", - "name", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.repositories_added", - "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "repository_selection", - "name", - "integration", - "operation_type", - "repositories_added", - "created_at", - "repositories_added_names", - "actor_is_bot", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" - }, - { - "action": "integration_installation.repositories_removed", - "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "repository_selection", - "repositories_removed", - "integration", - "created_at", - "name", - "repositories_removed_names", - "actor_is_bot", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" - }, - { - "action": "integration_installation.suspend", - "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "repository_selection", - "integration", - "operation_type", - "created_at", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.unsuspend", - "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "repository_selection", - "integration", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.version_updated", - "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "integration", - "name", - "operation_type", - "created_at", - "repository_selection", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" - }, - { - "action": "integration.manager_added", - "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "manager", - "operation_type", - "integration" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" - }, - { - "action": "integration.manager_removed", - "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "integration", - "name", - "created_at", - "manager" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" - }, - { - "action": "integration.remove_client_secret", - "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "integration.revoke_all_tokens", - "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.revoke_tokens", - "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.suspend", - "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "created_at", - "operation_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" - }, - { - "action": "integration.transfer", - "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "transfer_to_id", - "requester", - "requester_id", - "created_at", - "transfer_to", - "operation_type", - "integration", - "transfer_from", - "transfer_from_id", - "transfer_from_type", - "transfer_to_type" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" - }, - { - "action": "integration.unsuspend", - "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "created_at", - "operation_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" - }, - { - "action": "ip_allow_list.disable", - "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "ip_allow_list.disable_for_installed_apps", - "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "ip_allow_list.disable_user_level_enforcement", - "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "ip_allow_list.enable", - "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "ip_allow_list.enable_for_installed_apps", - "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "ip_allow_list.enable_user_level_enforcement", - "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "ip_allow_list_entry.create", - "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "active", - "ip_allow_list_entry", - "operation_type", - "created_at" - ] - }, - { - "action": "ip_allow_list_entry.destroy", - "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ip_allow_list_entry", - "operation_type", - "created_at", - "active" - ] - }, - { - "action": "ip_allow_list_entry.update", - "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "ip_allow_list_entry", - "active" - ] - }, - { - "action": "marketplace_agreement_signature.create", - "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.approve", - "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "secondary_category", - "primary_category", - "operation_type", - "created_at", - "marketplace_listing", - "integration" - ] - }, - { - "action": "marketplace_listing.change_category", - "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "marketplace_listing", - "integration", - "secondary_category", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.create", - "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "created_at", - "oauth_application", - "marketplace_listing", - "secondary_category", - "oauth_application_id", - "operation_type" - ] - }, - { - "action": "marketplace_listing.delist", - "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "secondary_category", - "operation_type", - "marketplace_listing", - "primary_category", - "integration" - ] - }, - { - "action": "marketplace_listing_plan.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "marketplace_listing", - "has_free_trial", - "yearly_price_in_cents", - "description", - "bullets", - "monthly_price_in_cents", - "marketplace_listing_plan" - ] - }, - { - "action": "marketplace_listing_plan.publish", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "marketplace_listing_plan", - "marketplace_listing", - "description", - "bullets", - "has_free_trial", - "created_at", - "operation_type", - "monthly_price_in_cents", - "yearly_price_in_cents" - ] - }, - { - "action": "marketplace_listing_plan.retire", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "marketplace_listing_plan", - "description", - "yearly_price_in_cents", - "created_at", - "bullets", - "has_free_trial", - "marketplace_listing", - "monthly_price_in_cents", - "operation_type" - ] - }, - { - "action": "marketplace_listing_plan.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "monthly_price_in_cents", - "marketplace_listing", - "description", - "bullets", - "yearly_price_in_cents", - "has_free_trial", - "marketplace_listing_plan", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.redraft", - "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "secondary_category", - "oauth_application_id", - "operation_type", - "oauth_application", - "created_at", - "marketplace_listing", - "primary_category" - ] - }, - { - "action": "marketplace_listing.reject", - "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "secondary_category", - "marketplace_listing", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "merge_queue.pull_request_dequeued", - "description": "A pull request was removed from a merge queue.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.pull_request_queue_jump", - "description": "A pull request was moved ahead in a merge queue.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.queue_cleared", - "description": "A merge queue was cleared.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.update_settings", - "description": "The settings for a merge queue were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "max_entries_to_build", - "min_entries_to_merge", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "metered_billing_configuration.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "metered_billing_configuration.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "metered_billing_configuration.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "migration.create", - "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "oauth_access.create", - "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" - }, - { - "action": "oauth_access.destroy", - "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "explanation", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" - }, - { - "action": "oauth_access.regenerate", - "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "oauth_application_name" - ] - }, - { - "action": "oauth_access.update", - "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "oauth_application.create", - "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "oauth_application" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.destroy", - "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "oauth_application" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.generate_client_secret", - "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.remove_client_secret", - "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.reset_secret", - "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "operation_type", - "created_at", - "oauth_application_id" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.revoke_all_tokens", - "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.revoke_tokens", - "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "oauth_application", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.suspend", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "oauth_application_id", - "created_at", - "oauth_application" - ] - }, - { - "action": "oauth_application.transfer", - "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "oauth_application", - "oauth_application_id" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.unsuspend", - "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "oauth_application_id", - "oauth_application", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_authorization.create", - "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" - }, - { - "action": "oauth_authorization.destroy", - "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "explanation", - "actor_is_bot", - "oauth_application_name" - ], - "docs_reference_titles": "Reviewing and revoking authorization of GitHub Apps" - }, - { - "action": "oauth_authorization.update", - "description": "An authorization for an OAuth application was updated.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" - }, - { - "action": "org.accept_business_invitation", - "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.add_billing_manager", - "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" - }, - { - "action": "org.add_member", - "description": "A user joined an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "org.add_outside_collaborator", - "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "inviter", - "public_repo", - "permission", - "invitee", - "created_at", - "operation_type" - ] - }, - { - "action": "org.add_security_manager", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "org.advanced_security_disabled_for_new_repos", - "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_disabled_on_all_repos", - "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_enabled_for_new_repos", - "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_enabled_on_all_repos", - "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_policy_selected_member_disabled", - "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "org.advanced_security_policy_selected_member_enabled", - "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "org.async_delete", - "description": "A user initiated a background job to delete an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.billing_signup_error", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.block_user", - "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "blocked_user", - "operation_type" - ], - "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" - }, - { - "action": "org.cancel_business_invitation", - "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "initiated_from" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.cancel_invitation", - "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "email", - "operation_type", - "invitation_id", - "created_at", - "invitee_email" - ] - }, - { - "action": "org.clear_custom_invitation_rate_limit", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.code_scanning_autofix_disabled", - "description": "Autofix for code scanning alerts was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_autofix_enabled", - "description": "Autofix for code scanning alerts was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.codeql_disabled", - "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Configuring default setup for code scanning at scale" - }, - { - "action": "org.codeql_enabled", - "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Configuring default setup for code scanning at scale" - }, - { - "action": "org.config.disable_collaborators_only", - "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.disable_contributors_only", - "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.disable_sockpuppet_disallowed", - "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.enable_collaborators_only", - "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.enable_contributors_only", - "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.enable_sockpuppet_disallowed", - "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.configure_self_hosted_jit_runner", - "description": "A new just-in-time GitHub Actions self-hosted runner was configured", - "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" - }, - { - "action": "org.confirm_business_invitation", - "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.create", - "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" - }, - { - "action": "org.delete", - "description": "An organization was deleted by a user or staff.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.disable_member_team_creation_permission", - "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" - }, - { - "action": "org.disable_reader_discussion_creation_permission", - "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" - }, - { - "action": "org.disable_saml", - "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sso_url", - "issuer", - "created_at", - "operation_type" - ] - }, - { - "action": "org.disable_two_factor_requirement", - "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.display_commenter_full_name_disabled", - "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.display_commenter_full_name_enabled", - "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.enable_member_team_creation_permission", - "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" - }, - { - "action": "org.enable_reader_discussion_creation_permission", - "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" - }, - { - "action": "org.enable_saml", - "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "sso_url", - "created_at", - "issuer" - ], - "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" - }, - { - "action": "org.enable_two_factor_requirement", - "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" - }, - { - "action": "org.integration_manager_added", - "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "manager", - "operation_type", - "created_at" - ] - }, - { - "action": "org.integration_manager_removed", - "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "manager", - "operation_type", - "created_at" - ] - }, - { - "action": "org.invite_member", - "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitation_id", - "operation_type", - "created_at", - "invitee_email" - ], - "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" - }, - { - "action": "org.invite_to_business", - "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.members_can_update_protected_branches.disable", - "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.members_can_update_protected_branches.enable", - "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.rate_limited_invites", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.recreate", - "description": "An organization was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.register_self_hosted_runner", - "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "org.remove_billing_manager", - "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" - }, - { - "action": "org.remove_member", - "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.remove_outside_collaborator", - "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.remove_security_manager", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "org.remove_self_hosted_runner", - "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Removing self-hosted runners" - }, - { - "action": "org.rename", - "description": "An organization was renamed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_login", - "operation_type", - "created_at" - ] - }, - { - "action": "org.restore_member", - "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" - }, - { - "action": "org.runner_group_created", - "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at", - "runner_group_restricted_to_workflows", - "runner_group_selected_workflow_refs", - "network_configuration_id" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_removed", - "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_runner_removed", - "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "runner_group_id", - "runner_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" - }, - { - "action": "org.runner_group_runners_added", - "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_runners_updated", - "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" - }, - { - "action": "org.runner_group_updated", - "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "runner_group_name", - "runner_group_allow_public", - "operation_type", - "created_at", - "runner_group_restricted_to_workflows", - "runner_group_selected_workflow_refs", - "network_configuration_id" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org_secret_scanning_automatic_validity_checks.disabled", - "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" - }, - { - "action": "org_secret_scanning_automatic_validity_checks.enabled", - "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" - }, - { - "action": "org_secret_scanning_custom_pattern.create", - "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_custom_pattern.delete", - "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_custom_pattern.publish", - "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org.secret_scanning_custom_pattern_push_protection_disabled", - "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org.secret_scanning_custom_pattern_push_protection_enabled", - "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_custom_pattern.update", - "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_non_provider_patterns.disabled", - "description": "Secret scanning for non-provider patterns was disabled at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "org_secret_scanning_non_provider_patterns.enabled", - "description": "Secret scanning for non-provider patterns was enabled at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.add", - "description": "A role or team was added to the push protection bypass list at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.disable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.enable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.remove", - "description": "A role or team was removed from the push protection bypass list at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_custom_message_disabled", - "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_custom_message_enabled", - "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_custom_message_updated", - "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_disable", - "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_enable", - "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_new_repos_disable", - "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_new_repos_enable", - "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.self_hosted_runner_offline", - "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "org.self_hosted_runner_online", - "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "org.self_hosted_runner_updated", - "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "source_version", - "target_version", - "runner_group_id", - "runner_group_name" - ], - "docs_reference_titles": "Self-hosted runners" - }, - { - "action": "org.set_actions_fork_pr_approvals_policy", - "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" - }, - { - "action": "org.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" - }, - { - "action": "org.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" - }, - { - "action": "org.set_custom_invitation_rate_limit", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" - }, - { - "action": "org.set_fork_pr_workflows_policy", - "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" - }, - { - "action": "org.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" - }, - { - "action": "org.sso_response", - "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "issuer", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "org.transform", - "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "owner" - ], - "docs_reference_titles": "Converting a user into an organization" - }, - { - "action": "org.unblock_user", - "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "blocked_user", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" - }, - { - "action": "org.update_actions_settings", - "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "new_policy", - "updated_allowed_types", - "old_policy", - "updated_access_policy" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" - }, - { - "action": "org.update_default_repository_permission", - "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "permission", - "old_permission" - ] - }, - { - "action": "org.update_member", - "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "old_permission", - "permission", - "operation_type" - ] - }, - { - "action": "org.update_member_repository_creation_permission", - "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "org.update_member_repository_invitation_permission", - "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Setting permissions for adding outside collaborators" - }, - { - "action": "org.update_saml_provider_settings", - "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sso_url", - "operation_type", - "issuer", - "created_at" - ] - }, - { - "action": "org.update_terms_of_service", - "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" - }, - { - "action": "organization_domain.approve", - "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "domain_name", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" - }, - { - "action": "organization_domain.create", - "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "domain_name", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" - }, - { - "action": "organization_domain.destroy", - "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "domain_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" - }, - { - "action": "organization_domain.verify", - "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "domain_name", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" - }, - { - "action": "packages.package_deleted", - "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "package", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" - }, - { - "action": "packages.package_published", - "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "package", - "ecosystem", - "version_count", - "is_republished", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "packages.package_version_deleted", - "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "package", - "version", - "operation_type", - "created_at", - "ecosystem", - "actor_is_bot" - ], - "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" - }, - { - "action": "packages.package_version_published", - "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ecosystem", - "package", - "version", - "is_republished", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "pages_protected_domain.create", - "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.delete", - "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.verify", - "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "passkey.register", - "description": "A new passkey was added.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "nickname", - "created_at", - "operation_type" - ] - }, - { - "action": "passkey.remove", - "description": "A new passkey was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "nickname", - "created_at", - "operation_type" - ] - }, - { - "action": "payment_method.create", - "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "payment_method.remove", - "description": "A payment method was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "payment_method.update", - "description": "An existing payment method was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "personal_access_token.access_granted", - "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.access_revoked", - "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.create", - "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ] - }, - { - "action": "personal_access_token.credential_regenerated", - "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "created_at", - "operation_type" - ] - }, - { - "action": "personal_access_token.credential_revoked", - "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" - }, - { - "action": "personal_access_token.destroy", - "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "explanation", - "created_at", - "operation_type" - ] - }, - { - "action": "personal_access_token.request_cancelled", - "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ] - }, - { - "action": "personal_access_token.request_created", - "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.request_denied", - "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.update", - "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" - }, - { - "action": "premium_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "premium_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "premium_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting_new_repos.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting_new_repos.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "profile_picture.update", - "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "owner", - "operation_type" - ], - "docs_reference_titles": "Personalize your profile" - }, - { - "action": "project.access", - "description": "A project board visibility was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.close", - "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "project_id", - "project_kind" - ], - "docs_reference_titles": "Closing a project (classic)" - }, - { - "action": "project.create", - "description": "A project board was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.delete", - "description": "A project board was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project_field.create", - "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" - }, - { - "action": "project_field.delete", - "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" - }, - { - "action": "project.link", - "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.open", - "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "project_id", - "operation_type", - "created_at", - "project_kind", - "project_name" - ], - "docs_reference_titles": "Reopening a closed project (classic)" - }, - { - "action": "project.rename", - "description": "A project board was renamed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "old_name", - "operation_type" - ] - }, - { - "action": "project.unlink", - "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.update_org_permission", - "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.update_team_permission", - "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "team" - ] - }, - { - "action": "project.update_user_permission", - "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project_view.create", - "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "project_view.delete", - "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "protected_branch.authorized_users_teams", - "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "operation_type", - "oauth_application_id" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" - }, - { - "action": "protected_branch.branch_allowances", - "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "authorized_actors", - "policy", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "protected_branch.create", - "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "created_at", - "authorized_actor_names", - "required_deployments_enforcement_level", - "merge_queue_enforcement_level", - "create_protected" - ] - }, - { - "action": "protected_branch.destroy", - "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "required_deployments_enforcement_level", - "merge_queue_enforcement_level", - "create_protected" - ] - }, - { - "action": "protected_branch.dismiss_stale_reviews", - "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "dismiss_stale_reviews_on_push", - "created_at", - "operation_type", - "name" - ] - }, - { - "action": "protected_branch.dismissal_restricted_users_teams", - "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "authorized_actors_only", - "authorized_actors", - "created_at", - "name", - "operation_type" - ] - }, - { - "action": "protected_branch.policy_override", - "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "reasons", - "before", - "after", - "operation_type", - "branch", - "overridden_codes", - "referrer", - "deploy_key_fingerprint", - "compliant_pull_request_ids", - "rule_suite_id" - ] - }, - { - "action": "protected_branch.rejected_ref_update", - "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "branch", - "before", - "overridden_codes", - "after", - "reasons", - "deploy_key_fingerprint", - "compliant_pull_request_ids", - "actor_is_bot", - "rule_suite_id" - ] - }, - { - "action": "protected_branch.update_admin_enforced", - "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "admin_enforced", - "operation_type", - "name", - "created_at" - ] - }, - { - "action": "protected_branch.update_allow_deletions_enforcement_level", - "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "allow_deletions_enforcement_level", - "created_at" - ] - }, - { - "action": "protected_branch.update_allow_force_pushes_enforcement_level", - "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "allow_force_pushes_enforcement_level", - "created_at" - ] - }, - { - "action": "protected_branch.update_ignore_approvals_from_contributors", - "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "ignore_approvals_from_contributors", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" - }, - { - "action": "protected_branch.update_linear_history_requirement_enforcement_level", - "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "linear_history_requirement_enforcement_level", - "name", - "created_at" - ] - }, - { - "action": "protected_branch.update_lock_allows_fetch_and_merge", - "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "lock_allows_fetch_and_merge", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" - }, - { - "action": "protected_branch.update_lock_branch_enforcement_level", - "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "enforcement_level", - "lock_branch_enforcement_level", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" - }, - { - "action": "protected_branch.update_merge_queue_enforcement_level", - "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "merge_queue_enforcement_level", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" - }, - { - "action": "protected_branch.update_name", - "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "old_name", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "protected_branch.update_pull_request_reviews_enforcement_level", - "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "pull_request_reviews_enforcement_level", - "created_at", - "operation_type" - ] - }, - { - "action": "protected_branch.update_require_code_owner_review", - "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "require_code_owner_review", - "operation_type", - "name" - ] - }, - { - "action": "protected_branch.update_require_last_push_approval", - "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "require_last_push_approval", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" - }, - { - "action": "protected_branch.update_required_approving_review_count", - "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "required_approving_review_count", - "created_at", - "operation_type", - "name" - ] - }, - { - "action": "protected_branch.update_required_status_checks_enforcement_level", - "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "required_status_checks_enforcement_level" - ] - }, - { - "action": "protected_branch.update_signature_requirement_enforcement_level", - "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "created_at", - "signature_requirement_enforcement_level" - ] - }, - { - "action": "protected_branch.update_strict_required_status_checks_policy", - "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "operation_type", - "strict_required_status_checks_policy" - ] - }, - { - "action": "public_key.create", - "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "read_only", - "operation_type", - "created_at", - "key", - "fingerprint", - "title" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" - }, - { - "action": "public_key.delete", - "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "fingerprint", - "read_only", - "explanation", - "key", - "operation_type", - "title", - "created_at" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" - }, - { - "action": "public_key.unverification_failure", - "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "title", - "key", - "fingerprint", - "read_only", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.unverify", - "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "title", - "key", - "read_only", - "explanation", - "fingerprint" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.update", - "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "fingerprint", - "read_only", - "operation_type", - "created_at", - "title" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.verification_failure", - "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "fingerprint", - "oauth_application_id", - "title", - "created_at", - "read_only", - "operation_type" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.verify", - "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "key", - "fingerprint", - "title", - "read_only" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "pull_request.close", - "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_bot" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" - }, - { - "action": "pull_request.converted_to_draft", - "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" - }, - { - "action": "pull_request.create", - "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_bot", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" - }, - { - "action": "pull_request.create_review_request", - "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "reviewer_type", - "reviewer", - "reviewer_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" - }, - { - "action": "pull_request.in_progress", - "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at" - ] - }, - { - "action": "pull_request.indirect_merge", - "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ] - }, - { - "action": "pull_request.merge", - "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_bot" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" - }, - { - "action": "pull_request.ready_for_review", - "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" - }, - { - "action": "pull_request.rebase", - "description": "A pull request was rebased.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "pull_request.remove_review_request", - "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "reviewer_type", - "reviewer", - "reviewer_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" - }, - { - "action": "pull_request.reopen", - "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ] - }, - { - "action": "pull_request_review_comment.create", - "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "comment_id", - "operation_type", - "created_at", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" - }, - { - "action": "pull_request_review_comment.delete", - "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "comment_id", - "operation_type" - ] - }, - { - "action": "pull_request_review_comment.update", - "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "comment_id" - ] - }, - { - "action": "pull_request_review.delete", - "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "review_id", - "operation_type", - "created_at", - "pull_request_url" - ] - }, - { - "action": "pull_request_review.dismiss", - "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "review_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" - }, - { - "action": "pull_request_review.submit", - "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "review_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" - }, - { - "action": "repo.access", - "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility", - "previous_visibility" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" - }, - { - "action": "repo.actions_enabled", - "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" - }, - { - "action": "repo.add_member", - "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type", - "oauth_application_id" - ], - "docs_reference_titles": "Inviting collaborators to a personal repository" - }, - { - "action": "repo.add_topic", - "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "topic", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" - }, - { - "action": "repo.advanced_security_disabled", - "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" - }, - { - "action": "repo.advanced_security_enabled", - "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" - }, - { - "action": "repo.archived", - "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository" - }, - { - "action": "repo.change_merge_setting", - "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type", - "public_repo", - "actor_is_bot" - ] - }, - { - "action": "repo.code_scanning_analysis_deleted", - "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at", - "public_repo", - "tool", - "category" - ], - "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" - }, - { - "action": "repo.code_scanning_autofix_disabled", - "description": "Autofix for code scanning alerts was disabled for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "repo.code_scanning_autofix_enabled", - "description": "Autofix for code scanning alerts was enabled for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "repo.code_scanning_configuration_for_branch_deleted", - "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "tool", - "branch", - "category", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Resolving code scanning alerts" - }, - { - "action": "repo.codeql_disabled", - "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Configuring default setup for code scanning" - }, - { - "action": "repo.codeql_enabled", - "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "query_suite", - "threat_model", - "languages" - ], - "docs_reference_titles": "Configuring default setup for code scanning" - }, - { - "action": "repo.codeql_updated", - "description": "Code scanning using the default setup was updated for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "query_suite", - "threat_model", - "languages", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Configuring default setup for code scanning" - }, - { - "action": "repo.collaborators_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.config.disable_collaborators_only", - "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.disable_contributors_only", - "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.disable_sockpuppet_disallowed", - "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_collaborators_only", - "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_contributors_only", - "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_sockpuppet_disallowed", - "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.configure_self_hosted_jit_runner", - "description": "A new just-in-time GitHub Actions self-hosted runner was configured", - "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" - }, - { - "action": "repo.create", - "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "request_category", - "created_at", - "oauth_application_id", - "request_method", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" - }, - { - "action": "repo.create_actions_secret", - "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.create_actions_variable", - "description": "A GitHub Actions variable was created for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.create_integration_secret", - "description": "A Codespaces or Dependabot secret was created for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.destroy", - "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "request_category", - "visibility", - "created_at", - "request_method", - "oauth_application_id", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" - }, - { - "action": "repo.disk_archive", - "description": "A repository was archived on disk.", - "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories" - }, - { - "action": "repo.download_zip", - "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" - }, - { - "action": "repo.hide_from_discovery", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "visibility", - "created_at" - ] - }, - { - "action": "repo.noindex", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "repo.override_unlock", - "description": "The repository was unlocked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_build", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility" - ] - }, - { - "action": "repo.pages_cname", - "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "cname", - "created_at", - "operation_type", - "old_cname" - ] - }, - { - "action": "repo.pages_create", - "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_destroy", - "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "repo.pages_https_redirect_disabled", - "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_https_redirect_enabled", - "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "repo.pages_private", - "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_public", - "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_soft_delete", - "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.pages_soft_delete_restore", - "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.pages_source", - "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "visibility", - "created_at" - ] - }, - { - "action": "repo.register_self_hosted_runner", - "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "repo.remove_actions_secret", - "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.remove_actions_variable", - "description": "A GitHub Actions variable was deleted for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.remove_integration_secret", - "description": "A Codespaces or Dependabot secret was deleted for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.remove_member", - "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "Removing a collaborator from a personal repository" - }, - { - "action": "repo.remove_self_hosted_runner", - "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Removing self-hosted runners" - }, - { - "action": "repo.remove_topic", - "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "topic", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.rename", - "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_name", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" - }, - { - "action": "repo.require_login", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "repo.restore", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.self_hosted_runner_offline", - "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "repo.self_hosted_runner_online", - "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "repo.self_hosted_runner_updated", - "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "source_version", - "target_version", - "runner_group_id", - "runner_group_name" - ], - "docs_reference_titles": "Self-hosted runners" - }, - { - "action": "repo.set_actions_fork_pr_approvals_policy", - "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" - }, - { - "action": "repo.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" - }, - { - "action": "repo.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" - }, - { - "action": "repo.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" - }, - { - "action": "repo.set_fork_pr_workflows_policy", - "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" - }, - { - "action": "repo.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" - }, - { - "action": "repo.staff_unlock", - "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.temporary_access_granted", - "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Accessing user-owned repositories in your enterprise" - }, - { - "action": "repo.transfer", - "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "old_user", - "operation_type", - "created_at", - "visibility", - "repo_was" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" - }, - { - "action": "repo.transfer_outgoing", - "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "new_nwo", - "visibility", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "repo.transfer_start", - "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility" - ] - }, - { - "action": "repo.unarchived", - "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository" - }, - { - "action": "repo.update_actions_access_settings", - "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "old_policy", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.update_actions_secret", - "description": "A GitHub Actions secret was updated for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.update_actions_settings", - "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "new_policy", - "old_policy", - "updated_access_policy", - "actor_is_bot" - ] - }, - { - "action": "repo.update_actions_variable", - "description": "A GitHub Actions variable was updated for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.update_default_branch", - "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "repo.update_integration_secret", - "description": "A Codespaces or Dependabot secret was updated for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.update_member", - "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "visibility", - "old_permission", - "old_base_role", - "old_repo_permission", - "old_repo_base_role", - "new_repo_base_role", - "new_repo_permission", - "actor_is_bot" - ] - }, - { - "action": "repository_branch_protection_evaluation.disable", - "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" - }, - { - "action": "repository_branch_protection_evaluation.enable", - "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" - }, - { - "action": "repository_image.create", - "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "content_type" - ] - }, - { - "action": "repository_image.destroy", - "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "content_type", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_invitation.accept", - "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "invitee", - "operation_type", - "inviter" - ] - }, - { - "action": "repository_invitation.cancel", - "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "inviter", - "operation_type", - "invitee", - "created_at" - ] - }, - { - "action": "repository_invitation.create", - "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitee", - "inviter", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_invitation.reject", - "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitee", - "operation_type", - "created_at", - "inviter" - ] - }, - { - "action": "repository_ruleset.create", - "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules", - "ruleset_conditions", - "ruleset_bypass_actors" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" - }, - { - "action": "repository_ruleset.destroy", - "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules", - "ruleset_bypass_actors" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" - }, - { - "action": "repository_ruleset.update", - "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules_updated", - "ruleset_conditions_added", - "ruleset_conditions_deleted", - "ruleset_old_enforcement", - "ruleset_rules_added", - "ruleset_rules_deleted", - "ruleset_old_name", - "ruleset_conditions_updated", - "ruleset_bypass_actors_added", - "ruleset_bypass_actors_deleted", - "ruleset_bypass_actors_updated", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" - }, - { - "action": "repository_secret_scanning_automatic_validity_checks.disabled", - "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" - }, - { - "action": "repository_secret_scanning_automatic_validity_checks.enabled", - "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" - }, - { - "action": "repository_secret_scanning_custom_pattern.create", - "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern.delete", - "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern.publish", - "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", - "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", - "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern.update", - "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning.disable", - "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "repository_secret_scanning.enable", - "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_secret_scanning_non_provider_patterns.disabled", - "description": "Secret scanning for non-provider patterns was disabled at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "repository_secret_scanning_non_provider_patterns.enabled", - "description": "Secret scanning for non-provider patterns was enabled at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.add", - "description": "A role or team was added to the push protection bypass list at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.disable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.enable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.remove", - "description": "A role or team was removed from the push protection bypass list at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection.disable", - "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection.enable", - "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "restrict_notification_delivery.disable", - "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" - }, - { - "action": "restrict_notification_delivery.enable", - "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" - }, - { - "action": "secret_scanning_alert.create", - "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo" - ], - "docs_reference_titles": "Manage secret scanning alerts" - }, - { - "action": "secret_scanning_alert.reopen", - "description": "A secret scanning alert was reopened.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "secret_type_display_name" - ] - }, - { - "action": "secret_scanning_alert.resolve", - "description": "A secret scanning alert was resolved.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "resolution", - "public_repo", - "created_at", - "operation_type", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo" - ] - }, - { - "action": "secret_scanning_alert.revoke", - "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "secret_scanning_alert.validate", - "description": "A secret scanning alert was validated.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "created_at", - "previous_validity", - "current_validity", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo" - ], - "docs_reference_titles": "Manage secret scanning alerts" - }, - { - "action": "secret_scanning.disable", - "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning.enable", - "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_new_repos.disable", - "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_new_repos.enable", - "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_push_protection.bypass", - "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "created_at", - "push_protection_bypass_reason", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo", - "request_reviewer", - "request_reviewer_id" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "secret_scanning_push_protection_request.approve", - "description": "A request to bypass secret scanning push protection was approved by a user.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "secret_scanning_push_protection_request.deny", - "description": "A request to bypass secret scanning push protection was denied by a user.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot", - "request_reviewer_comment" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "secret_scanning_push_protection_request.request", - "description": "A user requested to bypass secret scanning push protection.", - "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" - }, - { - "action": "security_key.register", - "description": "A security key was registered for an account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "security_key.remove", - "description": "A security key was removed from an account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "sponsors.agreement_sign", - "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.custom_amount_settings_change", - "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" - }, - { - "action": "sponsors.fiscal_host_change", - "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.repo_funding_links_file_action", - "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" - }, - { - "action": "sponsors.sponsor_sponsorship_cancel", - "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Downgrading a sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_create", - "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" - }, - { - "action": "sponsors.sponsor_sponsorship_payment_complete", - "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "active", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" - }, - { - "action": "sponsors.sponsor_sponsorship_preference_change", - "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_tier_change", - "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" - }, - { - "action": "sponsors.sponsored_developer_approve", - "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_create", - "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_disable", - "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "operation_type", - "created_at" - ] - }, - { - "action": "sponsors.sponsored_developer_profile_update", - "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" - }, - { - "action": "sponsors.sponsored_developer_redraft", - "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.sponsored_developer_request_approval", - "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_tier_description_update", - "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" - }, - { - "action": "sponsors.sponsored_developer_update_newsletter_send", - "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" - }, - { - "action": "sponsors.sponsors_patreon_user_create", - "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "patreon_email", - "patreon_username", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" - }, - { - "action": "sponsors.sponsors_patreon_user_destroy", - "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "patreon_email", - "patreon_username", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Unlinking your Patreon account from GitHub" - }, - { - "action": "sponsors.update_tier_repository", - "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.update_tier_welcome_message", - "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.waitlist_join", - "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.withdraw_agreement_signature", - "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "ssh_certificate_authority.create", - "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "fingerprint", - "operation_type", - "openssh_public_key", - "created_at" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "ssh_certificate_authority.destroy", - "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "fingerprint", - "operation_type", - "openssh_public_key" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "ssh_certificate_requirement.disable", - "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "ssh_certificate_requirement.enable", - "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "staff.set_domain_token_expiration", - "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "domain_name", - "token_expires_at", - "owner", - "operation_type", - "created_at" - ] - }, - { - "action": "staff.unverify_domain", - "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "owner_type", - "domain_name", - "owner", - "operation_type" - ] - }, - { - "action": "staff.verify_domain", - "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "domain_name", - "operation_type", - "created_at" - ] - }, - { - "action": "successor_invitation.accept", - "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.cancel", - "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.create", - "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.decline", - "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "successor_invitation.revoke", - "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "team.add_member", - "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type", - "team_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" - }, - { - "action": "team.add_repository", - "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "team.change_parent_team", - "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "team", - "operation_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" - }, - { - "action": "team.change_privacy", - "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type", - "team_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" - }, - { - "action": "team.create", - "description": "A new team is created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "team", - "created_at", - "team_type" - ] - }, - { - "action": "team.demote_maintainer", - "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" - }, - { - "action": "team.destroy", - "description": "A team was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "team", - "operation_type", - "team_type" - ] - }, - { - "action": "team_discussions.clear", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "team_discussions.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "team_discussions.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "team.promote_maintainer", - "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" - }, - { - "action": "team.remove_member", - "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "team", - "team_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" - }, - { - "action": "team.remove_repository", - "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "team", - "operation_type" - ] - }, - { - "action": "team.rename", - "description": "A team's name was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "team", - "operation_type", - "team_type" - ] - }, - { - "action": "team_sync_tenant.disabled", - "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" - }, - { - "action": "team_sync_tenant.enabled", - "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" - }, - { - "action": "team.update_repository_permission", - "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "old_permission", - "operation_type", - "created_at", - "permission", - "new_repo_permission", - "new_repo_base_role", - "old_repo_permission", - "old_repo_base_role" - ] - }, - { - "action": "trusted_device.register", - "description": "A new trusted device was added.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "trusted_device.remove", - "description": "A trusted device was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_account_recovery.abort", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.complete", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.ignore", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.staff_approve", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.staff_decline", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_account_recovery.start", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_account_recovery.two_factor_destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.add_factor", - "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" - }, - { - "action": "two_factor_authentication.disabled", - "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Disabling two-factor authentication for your personal account" - }, - { - "action": "two_factor_authentication.enabled", - "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Configuring two-factor authentication" - }, - { - "action": "two_factor_authentication.password_reset_fallback_sms", - "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.recovery_codes_regenerated", - "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.remove_factor", - "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" - }, - { - "action": "two_factor_authentication.sign_in_fallback_sms", - "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.update_fallback", - "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.add_email", - "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "email", - "created_at" - ], - "docs_reference_titles": "Adding an email address to your GitHub account" - }, - { - "action": "user.async_delete", - "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.audit_log_export", - "description": "Audit log entries were exported.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.block_user", - "description": "A user was blocked by another user.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "blocked_user", - "operation_type", - "created_at" - ] - }, - { - "action": "user.change_password", - "description": "A user changed their password.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.codespaces_trusted_repo_access_granted", - "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "user.codespaces_trusted_repo_access_revoked", - "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "user.correct_password_from_unrecognized_device", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.correct_password_from_unrecognized_device_and_location", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.correct_password_from_unrecognized_location", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.create", - "description": "A new user account was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "email", - "operation_type", - "created_at" - ] - }, - { - "action": "user.create_integration_secret", - "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "created_at", - "operation_type" - ] - }, - { - "action": "user.creation_rate_limit_exceeded", - "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "oauth_application_id" - ] - }, - { - "action": "user.delete", - "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.demote", - "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type" - ] - }, - { - "action": "user.destroy", - "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.device_verification_failure", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.device_verification_requested", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.device_verification_success", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.disable_collaborators_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.disable_contributors_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.disable_sockpuppet_disallowed", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user_email.confirm_claim", - "description": "An enterprise managed user claimed an email address.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "user_email.mark_as_unclaimed", - "description": "N/A", - "docs_reference_links": "An enterprise managed user unclaimed an email address.", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." - }, - { - "action": "user.enable_collaborators_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.enable_contributors_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.enable_sockpuppet_disallowed", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.failed_login", - "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.flag_as_large_scale_contributor", - "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.forgot_password", - "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "email", - "created_at" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" - }, - { - "action": "user.grant_github_developer", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.hide_private_contributions_count", - "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Manage visibility settings for private contributions" - }, - { - "action": "user.login", - "description": "A user signed in.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "passkey_nickname" - ] - }, - { - "action": "user.logout", - "description": "A user signed out.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.minimize_comment", - "description": "A comment made by a user was minimized.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.new_device_used", - "description": "A user signed in from a new device.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.partial_two_factor_email_followup", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.promote", - "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type" - ] - }, - { - "action": "user.recreate", - "description": "A user's account was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.remove_email", - "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "email" - ] - }, - { - "action": "user.remove_integration_secret", - "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "integration", - "created_at", - "operation_type" - ] - }, - { - "action": "user.remove_large_scale_contributor_flag", - "description": "A user account was no longer flagged as a large scale contributor.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.rename", - "description": "A username was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_login", - "created_at", - "operation_type" - ] - }, - { - "action": "user.report_abuse", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.report_content", - "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" - }, - { - "action": "user.reset_password", - "description": "A user reset their account password.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user_session.country_change", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.show_private_contributions_count", - "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Manage visibility settings for private contributions" - }, - { - "action": "user.sign_in_from_unrecognized_device", - "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.sign_in_from_unrecognized_device_and_location", - "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.sign_in_from_unrecognized_location", - "description": "A user signed in from an unrecognized location.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user_status.destroy", - "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "message", - "created_at", - "limited_availability", - "emoji", - "operation_type" - ] - }, - { - "action": "user_status.update", - "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "limited_availability", - "message", - "created_at", - "emoji", - "operation_type" - ], - "docs_reference_titles": "Personalize your profile" - }, - { - "action": "user.suspend", - "description": "A user account was suspended.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "user.toggle_warn_private_email", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_challenge_failure", - "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_challenge_success", - "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recover", - "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recovery_codes_downloaded", - "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recovery_codes_printed", - "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recovery_codes_viewed", - "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.two_factor_requested", - "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" - }, - { - "action": "user.unblock_user", - "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "blocked_user", - "operation_type", - "created_at" - ] - }, - { - "action": "user.unminimize_comment", - "description": "A comment made by a user was unminimized.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.unsuspend", - "description": "A user account was unsuspended.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "user.update_integration_secret", - "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "created_at", - "operation_type" - ] - }, - { - "action": "user.update_new_repository_default_branch_setting", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Reviewing deployments" - }, - { - "action": "workflows.bypass_protection_rules", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.cancel_workflow_run", - "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "run_number", - "cancelled_at", - "workflow_id", - "operation_type", - "trigger_id", - "public_repo" - ], - "docs_reference_titles": "Canceling a workflow run" - }, - { - "action": "workflows.comment_workflow_job", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.completed_workflow_run", - "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "completed_at", - "conclusion", - "run_number", - "workflow_id", - "operation_type", - "trigger_id", - "run_attempt", - "actor_is_bot", - "actor_is_agent" - ], - "docs_reference_titles": "Viewing workflow run history" - }, - { - "action": "workflows.created_workflow_run", - "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "workflow_id", - "operation_type", - "trigger_id", - "public_repo", - "actor_is_bot", - "actor_is_agent" - ], - "docs_reference_titles": "Understanding GitHub Actions" - }, - { - "action": "workflows.delete_workflow_run", - "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "workflow_run_id", - "started_at", - "head_branch", - "head_sha", - "trigger_id" - ], - "docs_reference_titles": "Deleting a workflow run" - }, - { - "action": "workflows.disable_workflow", - "description": "A workflow was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_id", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ] - }, - { - "action": "workflows.enable_workflow", - "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_id", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "workflows.pin_workflow", - "description": "A workflow was pinned.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "workflow_id", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "workflows.prepared_workflow_job", - "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "job_name", - "runner_labels", - "is_hosted_runner", - "environment_name", - "secrets_passed", - "operation_type", - "created_at", - "runner_owner_type", - "job_workflow_ref", - "calling_workflow_refs", - "calling_workflow_shas", - "imposer_repo" - ], - "docs_reference_titles": "Events that trigger workflows" - }, - { - "action": "workflows.reject_workflow_job", - "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Reviewing deployments" - }, - { - "action": "workflows.rerun_workflow_run", - "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "run_number", - "workflow_id", - "operation_type", - "trigger_id", - "run_attempt", - "rerun_type", - "check_run_id", - "actor_is_bot" - ], - "docs_reference_titles": "Re-running workflows and jobs" - }, - { - "action": "workflows.unpin_workflow", - "description": "A workflow was unpinned after previously being pinned.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "workflow_id", - "created_at", - "operation_type", - "actor_is_bot" - ] - } -] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.14/organization.json b/src/audit-logs/data/ghes-3.14/organization.json deleted file mode 100644 index 75b575cceb28..000000000000 --- a/src/audit-logs/data/ghes-3.14/organization.json +++ /dev/null @@ -1,22542 +0,0 @@ -[ - { - "action": "account.billing_date_change", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "account.plan_change", - "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "How GitHub billing works" - }, - { - "action": "actions_cache.delete", - "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "actions_cache_id", - "actions_cache_key", - "actions_cache_version", - "actions_cache_scope", - "created_at", - "operation_type" - ] - }, - { - "action": "advisory_credit.accept", - "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ghsa_id", - "recipient", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Editing a repository security advisory" - }, - { - "action": "advisory_credit.create", - "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ghsa_id", - "recipient", - "operation_type", - "created_at" - ] - }, - { - "action": "advisory_credit.decline", - "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ghsa_id", - "recipient", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "advisory_credit.destroy", - "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ghsa_id", - "recipient", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "artifact.destroy", - "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "auto_approve_personal_access_token_requests.disable", - "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, - { - "action": "auto_approve_personal_access_token_requests.enable", - "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" - }, - { - "action": "billing.change_billing_type", - "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing your payment and billing information" - }, - { - "action": "billing.change_email", - "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "email" - ], - "docs_reference_titles": "Managing your payment and billing information" - }, - { - "action": "billing.lock", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "billing.unlock", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "checks.auto_trigger_disabled", - "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" - }, - { - "action": "checks.auto_trigger_enabled", - "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" - }, - { - "action": "checks.delete_logs", - "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "codespaces.allow_permissions", - "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "origin_repository", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.attempted_to_create_from_prebuild", - "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "pull_request_id", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "codespaces.business_enablement_updated", - "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enablement", - "organization_names", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" - }, - { - "action": "codespaces.connect", - "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot", - "machine_type", - "devcontainer_path" - ] - }, - { - "action": "codespaces.create", - "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at", - "actor_is_bot", - "machine_type", - "devcontainer_path" - ], - "docs_reference_titles": "Creating a codespace for a repository" - }, - { - "action": "codespaces.destroy", - "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Deleting a codespace" - }, - { - "action": "codespaces.export_environment", - "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "owner", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "codespaces.policy_group_created", - "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.policy_group_deleted", - "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.policy_group_updated", - "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.restore", - "description": "A codespace was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.start_environment", - "description": "A codespace was started.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "pull_request_id", - "machine_type", - "devcontainer_path", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.suspend_environment", - "description": "A codespace was stopped.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "codespaces.trusted_repositories_access_update", - "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "commit_comment.destroy", - "description": "A commit comment was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "commit_comment.update", - "description": "A commit comment was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.access_revoked", - "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "reason", - "plan", - "owner", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_org_settings_changed", - "description": "Copilot feature settings were changed at the organization level.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_added", - "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_created", - "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "What is GitHub Copilot?" - }, - { - "action": "copilot.cfb_seat_assignment_refreshed", - "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_reused", - "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_unassigned", - "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_cancelled", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "seat_assignment" - ] - }, - { - "action": "copilot.cfb_seat_cancelled_by_staff", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_management_changed", - "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_value", - "new_value", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "copilot.content_exclusion_changed", - "description": "The excluded paths for GitHub Copilot were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "excluded_paths", - "owner_type", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.knowledge_base_created", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "copilot.knowledge_base_deleted", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "copilot.knowledge_base_updated", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "copilot.plan_changed", - "description": "The plan for GitHub Copilot was updated.", - "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_plan", - "plan", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "GitHub Copilot licenses" - }, - { - "action": "custom_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_property_definition.create", - "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "property_name", - "created_at", - "operation_type", - "value_type", - "required", - "default_value", - "definition_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_definition.destroy", - "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "property_name", - "created_at", - "operation_type", - "value_type", - "required", - "default_value", - "definition_id", - "allowed_values" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_definition.update", - "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "property_name", - "created_at", - "operation_type", - "value_type", - "required", - "default_value", - "old_allowed_values", - "allowed_values", - "definition_id", - "old_required", - "old_default_value", - "old_value_type", - "old_values_editable_by", - "values_editable_by" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_value.create", - "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "definition_id", - "property_name", - "value", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_value.destroy", - "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "custom_property_value.update", - "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "definition_id" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" - }, - { - "action": "dependabot_alerts.disable", - "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" - }, - { - "action": "dependabot_alerts.enable", - "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" - }, - { - "action": "dependabot_alerts_new_repos.disable", - "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_alerts_new_repos.enable", - "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_repository_access.repositories_updated", - "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "dependabot_security_updates.disable", - "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates.enable", - "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "dependabot_security_updates_new_repos.disable", - "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates_new_repos.enable", - "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "dependency_graph.disable", - "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependency_graph.enable", - "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "dependency_graph_new_repos.disable", - "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependency_graph_new_repos.enable", - "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "discussion_comment.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "discussion_comment.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "discussion.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "title", - "created_at" - ] - }, - { - "action": "discussion_post.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "number", - "title", - "operation_type" - ] - }, - { - "action": "discussion_post_reply.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "number", - "created_at" - ] - }, - { - "action": "discussion_post_reply.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "number", - "team", - "created_at" - ] - }, - { - "action": "discussion_post.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "title", - "operation_type", - "team", - "number" - ] - }, - { - "action": "enterprise_announcement.create", - "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "message", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Customizing user messages for your enterprise" - }, - { - "action": "enterprise_announcement.destroy", - "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Customizing user messages for your enterprise" - }, - { - "action": "enterprise_announcement.update", - "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "message", - "old_message", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Customizing user messages for your enterprise" - }, - { - "action": "enterprise_installation.create", - "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" - }, - { - "action": "enterprise_installation.destroy", - "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enabling GitHub Connect for GitHub.com" - }, - { - "action": "environment.add_protection_rule", - "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "environment.create_actions_secret", - "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create_actions_variable", - "description": "A variable was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "environment_name", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.delete", - "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.remove_actions_secret", - "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.remove_actions_variable", - "description": "A variable was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.remove_protection_rule", - "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.update_actions_secret", - "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.update_actions_variable", - "description": "A variable was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.update_protection_rule", - "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "new_value", - "approvers_was", - "approvers", - "can_admins_bypass", - "prevent_self_review" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "git.clone", - "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "transport_protocol", - "repository_public", - "transport_protocol_name" - ] - }, - { - "action": "git.fetch", - "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "transport_protocol", - "repository_public", - "transport_protocol_name" - ] - }, - { - "action": "git.push", - "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "transport_protocol", - "repository_public", - "transport_protocol_name" - ] - }, - { - "action": "github_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "github_hosted_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "github_hosted_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "hook.active_changed", - "description": "A hook's active status was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "events", - "active", - "active_was", - "hook_id", - "operation_type" - ] - }, - { - "action": "hook.config_changed", - "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "hook_id", - "created_at", - "oauth_application_id", - "events" - ] - }, - { - "action": "hook.create", - "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "hook_id", - "events", - "operation_type", - "name", - "created_at" - ], - "docs_reference_titles": "About webhooks" - }, - { - "action": "hook.destroy", - "description": "A hook was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "events", - "created_at", - "name", - "operation_type", - "oauth_application_id", - "hook_id" - ] - }, - { - "action": "hook.events_changed", - "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "events", - "operation_type", - "name", - "events_were", - "created_at", - "hook_id", - "oauth_application_id" - ] - }, - { - "action": "integration.create", - "description": "A GitHub App was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "integration", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.destroy", - "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "integration.generate_client_secret", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration_installation.create", - "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "repository_selection", - "created_at", - "integration", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" - }, - { - "action": "integration_installation.destroy", - "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "repository_selection", - "integration", - "operation_type", - "name", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.repositories_added", - "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "repository_selection", - "name", - "integration", - "operation_type", - "repositories_added", - "created_at", - "repositories_added_names", - "actor_is_bot", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" - }, - { - "action": "integration_installation.repositories_removed", - "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "repository_selection", - "repositories_removed", - "integration", - "created_at", - "name", - "repositories_removed_names", - "actor_is_bot", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" - }, - { - "action": "integration_installation_request.close", - "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "url", - "created_at", - "operation_type", - "integration", - "reason", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" - }, - { - "action": "integration_installation_request.create", - "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "requester", - "created_at", - "url", - "operation_type", - "integration", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" - }, - { - "action": "integration_installation.suspend", - "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "repository_selection", - "integration", - "operation_type", - "created_at", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.unsuspend", - "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "repository_selection", - "integration", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.version_updated", - "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "integration", - "name", - "operation_type", - "created_at", - "repository_selection", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" - }, - { - "action": "integration.manager_added", - "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "manager", - "operation_type", - "integration" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" - }, - { - "action": "integration.manager_removed", - "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "integration", - "name", - "created_at", - "manager" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" - }, - { - "action": "integration.remove_client_secret", - "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "integration.revoke_all_tokens", - "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.revoke_tokens", - "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.suspend", - "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "created_at", - "operation_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" - }, - { - "action": "integration.transfer", - "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "transfer_to_id", - "requester", - "requester_id", - "created_at", - "transfer_to", - "operation_type", - "integration", - "transfer_from", - "transfer_from_id", - "transfer_from_type", - "transfer_to_type" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" - }, - { - "action": "integration.unsuspend", - "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "created_at", - "operation_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" - }, - { - "action": "ip_allow_list.disable", - "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "ip_allow_list.disable_for_installed_apps", - "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "ip_allow_list.enable", - "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "ip_allow_list.enable_for_installed_apps", - "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "ip_allow_list_entry.create", - "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "active", - "ip_allow_list_entry", - "operation_type", - "created_at" - ] - }, - { - "action": "ip_allow_list_entry.destroy", - "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ip_allow_list_entry", - "operation_type", - "created_at", - "active" - ] - }, - { - "action": "ip_allow_list_entry.update", - "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "ip_allow_list_entry", - "active" - ] - }, - { - "action": "issue_comment.destroy", - "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "oauth_application_id" - ] - }, - { - "action": "issue_comment.pinned", - "description": "A comment on an issue was pinned to a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "issue_comment.unpinned", - "description": "A comment on an issue was unpinned from a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "issue_comment.update", - "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "oauth_application_id" - ] - }, - { - "action": "issue.destroy", - "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "title", - "operation_type" - ], - "docs_reference_titles": "Deleting an issue" - }, - { - "action": "issue.pinned", - "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "owner_type", - "number", - "event" - ], - "docs_reference_titles": "Pinning an issue to your repository" - }, - { - "action": "issue.transfer", - "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "number", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Transferring an issue to another repository" - }, - { - "action": "issue.unpinned", - "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "event", - "created_at", - "operation_type", - "number", - "owner_type" - ], - "docs_reference_titles": "Pinning an issue to your repository" - }, - { - "action": "issues.deletes_disabled", - "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "issues.deletes_enabled", - "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "issues.deletes_policy_cleared", - "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "marketplace_agreement_signature.create", - "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.approve", - "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "secondary_category", - "primary_category", - "operation_type", - "created_at", - "marketplace_listing", - "integration" - ] - }, - { - "action": "marketplace_listing.change_category", - "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "marketplace_listing", - "integration", - "secondary_category", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.create", - "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "created_at", - "oauth_application", - "marketplace_listing", - "secondary_category", - "oauth_application_id", - "operation_type" - ] - }, - { - "action": "marketplace_listing.delist", - "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "secondary_category", - "operation_type", - "marketplace_listing", - "primary_category", - "integration" - ] - }, - { - "action": "marketplace_listing.redraft", - "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "secondary_category", - "oauth_application_id", - "operation_type", - "oauth_application", - "created_at", - "marketplace_listing", - "primary_category" - ] - }, - { - "action": "marketplace_listing.reject", - "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "secondary_category", - "marketplace_listing", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "members_can_create_pages.disable", - "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" - }, - { - "action": "members_can_create_pages.enable", - "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" - }, - { - "action": "members_can_create_private_pages.disable", - "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" - }, - { - "action": "members_can_create_private_pages.enable", - "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" - }, - { - "action": "members_can_create_public_pages.disable", - "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" - }, - { - "action": "members_can_create_public_pages.enable", - "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" - }, - { - "action": "members_can_delete_repos.clear", - "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "members_can_delete_repos.disable", - "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "members_can_delete_repos.enable", - "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing repository management policies in your enterprise" - }, - { - "action": "members_can_view_dependency_insights.clear", - "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "members_can_view_dependency_insights.disable", - "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "members_can_view_dependency_insights.enable", - "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "merge_queue.pull_request_dequeued", - "description": "A pull request was removed from a merge queue.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.pull_request_queue_jump", - "description": "A pull request was moved ahead in a merge queue.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.queue_cleared", - "description": "A merge queue was cleared.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.update_settings", - "description": "The settings for a merge queue were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "max_entries_to_build", - "min_entries_to_merge", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "metered_billing_configuration.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "metered_billing_configuration.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "metered_billing_configuration.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "migration.create", - "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "migration.destroy_file", - "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "migration.download", - "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "network_configuration.create", - "description": "A network configuration for a hosted compute service was created.", - "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot", - "selected_service", - "network_settings_ids", - "previous_settings_ids", - "network_configuration_id", - "failover_network_settings_ids", - "failover_network_enabled" - ], - "docs_reference_titles": "About networking for hosted compute products in your enterprise" - }, - { - "action": "network_configuration.delete", - "description": "A network configuration for a hosted compute service was deleted.", - "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot", - "network_configuration_id" - ], - "docs_reference_titles": "About networking for hosted compute products in your enterprise" - }, - { - "action": "network_configuration.update", - "description": "A network configuration for a hosted compute service was updated.", - "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot", - "selected_service", - "network_settings_ids", - "previous_settings_ids", - "failover_network_settings_ids", - "failover_network_enabled" - ], - "docs_reference_titles": "About networking for hosted compute products in your enterprise" - }, - { - "action": "oauth_application.create", - "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "oauth_application" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.destroy", - "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "oauth_application" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.generate_client_secret", - "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.remove_client_secret", - "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.reset_secret", - "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "operation_type", - "created_at", - "oauth_application_id" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.revoke_all_tokens", - "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.revoke_tokens", - "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "oauth_application", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.transfer", - "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "oauth_application", - "oauth_application_id" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "org.accept_business_invitation", - "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.add_billing_manager", - "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" - }, - { - "action": "org.add_member", - "description": "A user joined an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "org.add_outside_collaborator", - "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "inviter", - "public_repo", - "permission", - "invitee", - "created_at", - "operation_type" - ] - }, - { - "action": "org.add_security_manager", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "org.advanced_security_disabled_for_new_repos", - "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_disabled_on_all_repos", - "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_enabled_for_new_repos", - "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_enabled_on_all_repos", - "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_policy_selected_member_disabled", - "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "org.advanced_security_policy_selected_member_enabled", - "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise" - }, - { - "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", - "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations" - }, - { - "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", - "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests" - }, - { - "action": "org.archive", - "description": "The organization was archived.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.audit_log_export", - "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" - }, - { - "action": "org.audit_log_git_event_export", - "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "start", - "end", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" - }, - { - "action": "org.billing_signup_error", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.block_user", - "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "blocked_user", - "operation_type" - ], - "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" - }, - { - "action": "org.cancel_business_invitation", - "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "initiated_from" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.cancel_invitation", - "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "email", - "operation_type", - "invitation_id", - "created_at", - "invitee_email" - ] - }, - { - "action": "org.clear_custom_invitation_rate_limit", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.code_scanning_autofix_disabled", - "description": "Autofix for code scanning alerts was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_autofix_enabled", - "description": "Autofix for code scanning alerts was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.codeql_disabled", - "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Configuring default setup for code scanning at scale" - }, - { - "action": "org.codeql_enabled", - "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Configuring default setup for code scanning at scale" - }, - { - "action": "org.codespaces_access_updated", - "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "enablement", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" - }, - { - "action": "org.codespaces_ownership_updated", - "description": "Ownership and payment for codespaces was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" - }, - { - "action": "org.codespaces_team_access_allowed", - "description": "A team has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "org.codespaces_team_access_revoked", - "description": "A team has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "org.codespaces_trusted_repo_access_granted", - "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "org.codespaces_trusted_repo_access_revoked", - "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "org.codespaces_user_access_allowed", - "description": "A user has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.codespaces_user_access_revoked", - "description": "A user has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.config.disable_collaborators_only", - "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.disable_contributors_only", - "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.disable_sockpuppet_disallowed", - "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.enable_collaborators_only", - "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.enable_contributors_only", - "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.config.enable_sockpuppet_disallowed", - "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" - }, - { - "action": "org.configure_self_hosted_jit_runner", - "description": "A new just-in-time GitHub Actions self-hosted runner was configured", - "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization" - }, - { - "action": "org.confirm_business_invitation", - "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.connect_usage_metrics_export", - "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Exporting Server Statistics" - }, - { - "action": "org.create", - "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" - }, - { - "action": "org.create_actions_secret", - "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "org.create_actions_variable", - "description": "A GitHub Actions variable was created for an organization.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "org.create_integration_secret", - "description": "A Codespaces or Dependabot secret was created for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "org_credential_authorization.deauthorize", - "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot", - "oauth_credential_type", - "managed_oauth_access_id", - "managed_token_id", - "managed_oauth_scopes", - "managed_token_scopes", - "managed_hashed_token" - ], - "docs_reference_titles": "Authorizing a personal access token for use with single sign-on" - }, - { - "action": "org_credential_authorization.grant", - "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot", - "oauth_credential_type", - "managed_oauth_access_id", - "managed_token_id", - "managed_oauth_scopes", - "managed_token_scopes", - "managed_hashed_token" - ], - "docs_reference_titles": "Authenticating with single sign-on" - }, - { - "action": "org_credential_authorization.revoke", - "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "oauth_application_id", - "operation_type", - "created_at", - "oauth_credential_type", - "managed_oauth_access_id", - "managed_token_id", - "managed_oauth_scopes", - "managed_token_scopes", - "managed_hashed_token" - ], - "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" - }, - { - "action": "org.disable_member_team_creation_permission", - "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" - }, - { - "action": "org.disable_oauth_app_restrictions", - "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" - }, - { - "action": "org.disable_reader_discussion_creation_permission", - "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" - }, - { - "action": "org.disable_saml", - "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sso_url", - "issuer", - "created_at", - "operation_type" - ] - }, - { - "action": "org.disable_source_ip_disclosure", - "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" - }, - { - "action": "org.disable_two_factor_requirement", - "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.display_commenter_full_name_disabled", - "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.display_commenter_full_name_enabled", - "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.enable_member_team_creation_permission", - "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" - }, - { - "action": "org.enable_oauth_app_restrictions", - "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" - }, - { - "action": "org.enable_reader_discussion_creation_permission", - "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" - }, - { - "action": "org.enable_saml", - "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "sso_url", - "created_at", - "issuer" - ], - "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization" - }, - { - "action": "org.enable_source_ip_disclosure", - "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" - }, - { - "action": "org.enable_two_factor_requirement", - "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" - }, - { - "action": "org.integration_manager_added", - "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "manager", - "operation_type", - "created_at" - ] - }, - { - "action": "org.integration_manager_removed", - "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "manager", - "operation_type", - "created_at" - ] - }, - { - "action": "org.invite_member", - "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitation_id", - "operation_type", - "created_at", - "invitee_email" - ], - "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" - }, - { - "action": "org.invite_to_business", - "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.members_can_update_protected_branches.disable", - "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.members_can_update_protected_branches.enable", - "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.oauth_app_access_approved", - "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "url", - "operation_type", - "created_at", - "oauth_application_name" - ], - "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" - }, - { - "action": "org.oauth_app_access_blocked", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "url", - "created_at", - "operation_type", - "oauth_application_name" - ] - }, - { - "action": "org.oauth_app_access_denied", - "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "url", - "created_at", - "operation_type", - "oauth_application_name" - ], - "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" - }, - { - "action": "org.oauth_app_access_requested", - "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "url", - "oauth_application_name" - ] - }, - { - "action": "org.oauth_app_access_unblocked", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "url", - "created_at", - "operation_type", - "oauth_application_name" - ] - }, - { - "action": "org.rate_limited_invites", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.recovery_code_failed", - "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "reason", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" - }, - { - "action": "org.recovery_code_used", - "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Accessing your organization if your identity provider is unavailable" - }, - { - "action": "org.recovery_codes_downloaded", - "description": "An organization owner downloaded the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" - }, - { - "action": "org.recovery_codes_generated", - "description": "An organization owner generated the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" - }, - { - "action": "org.recovery_codes_printed", - "description": "An organization owner printed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" - }, - { - "action": "org.recovery_codes_viewed", - "description": "An organization owner viewed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes" - }, - { - "action": "org.register_self_hosted_runner", - "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "org.remove_actions_secret", - "description": "A GitHub Actions secret was removed from an organization.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "org.remove_actions_variable", - "description": "A GitHub Actions variable was removed from an organization.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "org.remove_billing_manager", - "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" - }, - { - "action": "org.remove_integration_secret", - "description": "A Codespaces or Dependabot secret was removed from an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "org.remove_member", - "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.remove_outside_collaborator", - "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.remove_security_manager", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "org.remove_self_hosted_runner", - "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Removing self-hosted runners" - }, - { - "action": "org.rename", - "description": "An organization was renamed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_login", - "operation_type", - "created_at" - ] - }, - { - "action": "org.required_workflow_create", - "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/actions/using-workflows/required-workflows" - }, - { - "action": "org.required_workflow_delete", - "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/actions/using-workflows/required-workflows" - }, - { - "action": "org.required_workflow_update", - "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/actions/using-workflows/required-workflows" - }, - { - "action": "org.restore_member", - "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" - }, - { - "action": "org.revoke_external_identity", - "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" - }, - { - "action": "org.revoke_sso_session", - "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Viewing and managing a member's SAML access to your organization" - }, - { - "action": "org.runner_group_created", - "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at", - "runner_group_restricted_to_workflows", - "runner_group_selected_workflow_refs", - "network_configuration_id" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_removed", - "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_renamed", - "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_runner_removed", - "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "runner_group_id", - "runner_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" - }, - { - "action": "org.runner_group_runners_added", - "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_runners_updated", - "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "runner_group_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" - }, - { - "action": "org.runner_group_updated", - "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "runner_group_name", - "runner_group_allow_public", - "operation_type", - "created_at", - "runner_group_restricted_to_workflows", - "runner_group_selected_workflow_refs", - "network_configuration_id" - ], - "docs_reference_titles": "Managing access to self-hosted runners using groups" - }, - { - "action": "org.runner_group_visiblity_updated", - "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_group_id", - "visibility", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" - }, - { - "action": "org_secret_scanning_automatic_validity_checks.disabled", - "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" - }, - { - "action": "org_secret_scanning_automatic_validity_checks.enabled", - "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" - }, - { - "action": "org_secret_scanning_custom_pattern.create", - "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_custom_pattern.delete", - "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_custom_pattern.publish", - "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org.secret_scanning_custom_pattern_push_protection_disabled", - "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org.secret_scanning_custom_pattern_push_protection_enabled", - "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_custom_pattern.update", - "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "org_secret_scanning_generic_secrets.disabled", - "description": "Generic secrets have been disabled at the organization level", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org_secret_scanning_generic_secrets.enabled", - "description": "Generic secrets have been enabled at the organization level", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org_secret_scanning_non_provider_patterns.disabled", - "description": "Secret scanning for non-provider patterns was disabled at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "org_secret_scanning_non_provider_patterns.enabled", - "description": "Secret scanning for non-provider patterns was enabled at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.add", - "description": "A role or team was added to the push protection bypass list at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.disable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.enable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org_secret_scanning_push_protection_bypass_list.remove", - "description": "A role or team was removed from the push protection bypass list at the organization level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_custom_message_disabled", - "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_custom_message_enabled", - "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_custom_message_updated", - "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_disable", - "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_enable", - "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_new_repos_disable", - "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.secret_scanning_push_protection_new_repos_enable", - "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "org.self_hosted_runner_offline", - "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "org.self_hosted_runner_online", - "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "org.self_hosted_runner_updated", - "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "source_version", - "target_version", - "runner_group_id", - "runner_group_name" - ], - "docs_reference_titles": "Self-hosted runners" - }, - { - "action": "org.set_actions_fork_pr_approvals_policy", - "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" - }, - { - "action": "org.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" - }, - { - "action": "org.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" - }, - { - "action": "org.set_custom_invitation_rate_limit", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" - }, - { - "action": "org.set_fork_pr_workflows_policy", - "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" - }, - { - "action": "org.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" - }, - { - "action": "org.sso_response", - "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "issuer", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "org.transfer", - "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "from_business", - "to_business", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.transfer_outgoing", - "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "from_business", - "to_business", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Adding organizations to your enterprise" - }, - { - "action": "org.unarchive", - "description": "The organization was unarchived.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.unblock_user", - "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "blocked_user", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" - }, - { - "action": "org.update_actions_secret", - "description": "A GitHub Actions secret was updated for an organization.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "key", - "operation_type" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "org.update_actions_settings", - "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "new_policy", - "updated_allowed_types", - "old_policy", - "updated_access_policy" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" - }, - { - "action": "org.update_actions_variable", - "description": "A GitHub Actions variable was updated for an organization.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "org.update_default_repository_permission", - "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "permission", - "old_permission" - ] - }, - { - "action": "org.update_integration_secret", - "description": "A Codespaces or Dependabot secret was updated for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "org.update_member", - "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "old_permission", - "permission", - "operation_type" - ] - }, - { - "action": "org.update_member_repository_creation_permission", - "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "org.update_member_repository_invitation_permission", - "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Setting permissions for adding outside collaborators" - }, - { - "action": "org.update_new_repository_default_branch_setting", - "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" - }, - { - "action": "org.update_repo_self_hosted_runners_policy", - "description": "The repository self-hosted runners policy was updated", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_repo_runners_policy", - "new_repo_runners_policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners" - }, - { - "action": "org.update_saml_provider_settings", - "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sso_url", - "operation_type", - "issuer", - "created_at" - ] - }, - { - "action": "org.update_terms_of_service", - "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" - }, - { - "action": "organization_default_label.create", - "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" - }, - { - "action": "organization_default_label.destroy", - "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" - }, - { - "action": "organization_default_label.update", - "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" - }, - { - "action": "organization_domain.approve", - "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "domain_name", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" - }, - { - "action": "organization_domain.create", - "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "domain_name", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" - }, - { - "action": "organization_domain.destroy", - "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "domain_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" - }, - { - "action": "organization_domain.verify", - "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "domain_name", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" - }, - { - "action": "organization_moderators.add_team", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "organization_moderators.add_user", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "organization_moderators.remove_team", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type" - ] - }, - { - "action": "organization_moderators.remove_user", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "organization_projects_change.clear", - "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for projects in your enterprise" - }, - { - "action": "organization_projects_change.disable", - "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for projects in your enterprise" - }, - { - "action": "organization_projects_change.enable", - "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for projects in your enterprise" - }, - { - "action": "organization_role.assign", - "description": "An organization role was assigned to a user or team.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "organization_role_id", - "organization_role_name", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Permissions of custom organization roles" - }, - { - "action": "organization_role.create", - "description": "A custom organization role was created in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "role_permissions", - "base_role", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Permissions of custom organization roles" - }, - { - "action": "organization_role.destroy", - "description": "A custom organization role was deleted in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "role_permissions", - "base_role", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Permissions of custom organization roles" - }, - { - "action": "organization_role.revoke", - "description": "A user or team was unassigned an organization role.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "organization_role_id", - "organization_role_name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Permissions of custom organization roles" - }, - { - "action": "organization_role.update", - "description": "A custom organization role was edited in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "role_permissions", - "base_role", - "old_role_permissions", - "created_at", - "operation_type", - "actor_is_bot", - "old_base_role" - ], - "docs_reference_titles": "Permissions of custom organization roles" - }, - { - "action": "packages.package_deleted", - "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "package", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" - }, - { - "action": "packages.package_published", - "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "package", - "ecosystem", - "version_count", - "is_republished", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "packages.package_version_deleted", - "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "package", - "version", - "operation_type", - "created_at", - "ecosystem", - "actor_is_bot" - ], - "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package" - }, - { - "action": "packages.package_version_published", - "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "ecosystem", - "package", - "version", - "is_republished", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "pages_protected_domain.create", - "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.delete", - "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.verify", - "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "payment_method.create", - "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "payment_method.remove", - "description": "A payment method was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "payment_method.update", - "description": "An existing payment method was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "personal_access_token.access_granted", - "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.access_revoked", - "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.request_cancelled", - "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ] - }, - { - "action": "personal_access_token.request_created", - "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.request_denied", - "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "prebuild_configuration.create", - "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "branch", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" - }, - { - "action": "prebuild_configuration.destroy", - "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "branch", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" - }, - { - "action": "prebuild_configuration.run_triggered", - "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "branch", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" - }, - { - "action": "prebuild_configuration.update", - "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "branch", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" - }, - { - "action": "premium_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "premium_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "premium_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "private_repository_forking.clear", - "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "private_repository_forking.disable", - "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_repository_forking.enable", - "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "private_vulnerability_reporting.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting_new_repos.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting_new_repos.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "profile_picture.update", - "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "owner", - "operation_type" - ], - "docs_reference_titles": "Personalize your profile" - }, - { - "action": "project.access", - "description": "A project board visibility was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.close", - "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "project_id", - "project_kind" - ], - "docs_reference_titles": "Closing a project (classic)" - }, - { - "action": "project.create", - "description": "A project board was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.delete", - "description": "A project board was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project_field.create", - "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" - }, - { - "action": "project_field.delete", - "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" - }, - { - "action": "project.link", - "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.open", - "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "project_id", - "operation_type", - "created_at", - "project_kind", - "project_name" - ], - "docs_reference_titles": "Reopening a closed project (classic)" - }, - { - "action": "project.rename", - "description": "A project board was renamed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "old_name", - "operation_type" - ] - }, - { - "action": "project.unlink", - "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.update_org_permission", - "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.update_team_permission", - "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "team" - ] - }, - { - "action": "project.update_user_permission", - "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project_view.create", - "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "project_view.delete", - "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "protected_branch.authorized_users_teams", - "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "operation_type", - "oauth_application_id" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" - }, - { - "action": "protected_branch.branch_allowances", - "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "authorized_actors", - "policy", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "protected_branch.create", - "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "created_at", - "authorized_actor_names", - "required_deployments_enforcement_level", - "merge_queue_enforcement_level", - "create_protected" - ] - }, - { - "action": "protected_branch.destroy", - "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "required_deployments_enforcement_level", - "merge_queue_enforcement_level", - "create_protected" - ] - }, - { - "action": "protected_branch.dismiss_stale_reviews", - "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "dismiss_stale_reviews_on_push", - "created_at", - "operation_type", - "name" - ] - }, - { - "action": "protected_branch.dismissal_restricted_users_teams", - "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "authorized_actors_only", - "authorized_actors", - "created_at", - "name", - "operation_type" - ] - }, - { - "action": "protected_branch.policy_override", - "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "reasons", - "before", - "after", - "operation_type", - "branch", - "overridden_codes", - "referrer", - "deploy_key_fingerprint", - "compliant_pull_request_ids", - "rule_suite_id" - ] - }, - { - "action": "protected_branch.rejected_ref_update", - "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "branch", - "before", - "overridden_codes", - "after", - "reasons", - "deploy_key_fingerprint", - "compliant_pull_request_ids", - "actor_is_bot", - "rule_suite_id" - ] - }, - { - "action": "protected_branch.update_admin_enforced", - "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "admin_enforced", - "operation_type", - "name", - "created_at" - ] - }, - { - "action": "protected_branch.update_allow_deletions_enforcement_level", - "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "allow_deletions_enforcement_level", - "created_at" - ] - }, - { - "action": "protected_branch.update_allow_force_pushes_enforcement_level", - "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "allow_force_pushes_enforcement_level", - "created_at" - ] - }, - { - "action": "protected_branch.update_ignore_approvals_from_contributors", - "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "ignore_approvals_from_contributors", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" - }, - { - "action": "protected_branch.update_linear_history_requirement_enforcement_level", - "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "linear_history_requirement_enforcement_level", - "name", - "created_at" - ] - }, - { - "action": "protected_branch.update_lock_allows_fetch_and_merge", - "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "lock_allows_fetch_and_merge", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" - }, - { - "action": "protected_branch.update_lock_branch_enforcement_level", - "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "enforcement_level", - "lock_branch_enforcement_level", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" - }, - { - "action": "protected_branch.update_merge_queue_enforcement_level", - "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "merge_queue_enforcement_level", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" - }, - { - "action": "protected_branch.update_name", - "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "old_name", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "protected_branch.update_pull_request_reviews_enforcement_level", - "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "pull_request_reviews_enforcement_level", - "created_at", - "operation_type" - ] - }, - { - "action": "protected_branch.update_require_code_owner_review", - "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "require_code_owner_review", - "operation_type", - "name" - ] - }, - { - "action": "protected_branch.update_require_last_push_approval", - "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "require_last_push_approval", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" - }, - { - "action": "protected_branch.update_required_approving_review_count", - "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "required_approving_review_count", - "created_at", - "operation_type", - "name" - ] - }, - { - "action": "protected_branch.update_required_status_checks_enforcement_level", - "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "required_status_checks_enforcement_level" - ] - }, - { - "action": "protected_branch.update_signature_requirement_enforcement_level", - "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "created_at", - "signature_requirement_enforcement_level" - ] - }, - { - "action": "protected_branch.update_strict_required_status_checks_policy", - "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "operation_type", - "strict_required_status_checks_policy" - ] - }, - { - "action": "public_key.create", - "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "read_only", - "operation_type", - "created_at", - "key", - "fingerprint", - "title" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" - }, - { - "action": "public_key.delete", - "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "fingerprint", - "read_only", - "explanation", - "key", - "operation_type", - "title", - "created_at" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" - }, - { - "action": "public_key.unverification_failure", - "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "title", - "key", - "fingerprint", - "read_only", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.unverify", - "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "title", - "key", - "read_only", - "explanation", - "fingerprint" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.update", - "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "fingerprint", - "read_only", - "operation_type", - "created_at", - "title" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.verification_failure", - "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "fingerprint", - "oauth_application_id", - "title", - "created_at", - "read_only", - "operation_type" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.verify", - "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "key", - "fingerprint", - "title", - "read_only" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "pull_request.close", - "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_bot" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" - }, - { - "action": "pull_request.converted_to_draft", - "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" - }, - { - "action": "pull_request.create", - "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_bot", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" - }, - { - "action": "pull_request.create_review_request", - "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "reviewer_type", - "reviewer", - "reviewer_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" - }, - { - "action": "pull_request.in_progress", - "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at" - ] - }, - { - "action": "pull_request.indirect_merge", - "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ] - }, - { - "action": "pull_request.merge", - "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_bot" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" - }, - { - "action": "pull_request.ready_for_review", - "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" - }, - { - "action": "pull_request.rebase", - "description": "A pull request was rebased.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "pull_request_url", - "pull_request_title", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "pull_request.remove_review_request", - "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "reviewer_type", - "reviewer", - "reviewer_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" - }, - { - "action": "pull_request.reopen", - "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "operation_type", - "created_at", - "pull_request_url" - ] - }, - { - "action": "pull_request_review_comment.create", - "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "comment_id", - "operation_type", - "created_at", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" - }, - { - "action": "pull_request_review_comment.delete", - "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "comment_id", - "operation_type" - ] - }, - { - "action": "pull_request_review_comment.update", - "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "comment_id" - ] - }, - { - "action": "pull_request_review.delete", - "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "review_id", - "operation_type", - "created_at", - "pull_request_url" - ] - }, - { - "action": "pull_request_review.dismiss", - "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "review_id", - "operation_type", - "created_at", - "pull_request_url" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" - }, - { - "action": "pull_request_review.submit", - "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "review_id", - "operation_type", - "created_at", - "pull_request_url", - "actor_is_agent" - ], - "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" - }, - { - "action": "repo.access", - "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility", - "previous_visibility" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" - }, - { - "action": "repo.actions_enabled", - "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" - }, - { - "action": "repo.add_member", - "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type", - "oauth_application_id" - ], - "docs_reference_titles": "Inviting collaborators to a personal repository" - }, - { - "action": "repo.add_topic", - "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "topic", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" - }, - { - "action": "repo.advanced_security_disabled", - "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" - }, - { - "action": "repo.advanced_security_enabled", - "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" - }, - { - "action": "repo.archived", - "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository" - }, - { - "action": "repo.change_merge_setting", - "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type", - "public_repo", - "actor_is_bot" - ] - }, - { - "action": "repo.code_scanning_analysis_deleted", - "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at", - "public_repo", - "tool", - "category" - ], - "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" - }, - { - "action": "repo.code_scanning_autofix_disabled", - "description": "Autofix for code scanning alerts was disabled for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "repo.code_scanning_autofix_enabled", - "description": "Autofix for code scanning alerts was enabled for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "repo.code_scanning_configuration_for_branch_deleted", - "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "tool", - "branch", - "category", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Resolving code scanning alerts" - }, - { - "action": "repo.codeql_disabled", - "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Configuring default setup for code scanning" - }, - { - "action": "repo.codeql_enabled", - "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "query_suite", - "threat_model", - "languages" - ], - "docs_reference_titles": "Configuring default setup for code scanning" - }, - { - "action": "repo.codeql_updated", - "description": "Code scanning using the default setup was updated for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "query_suite", - "threat_model", - "languages", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Configuring default setup for code scanning" - }, - { - "action": "repo.codespaces_trusted_repo_access_granted", - "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.codespaces_trusted_repo_access_revoked", - "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.config.disable_collaborators_only", - "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.disable_contributors_only", - "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.disable_sockpuppet_disallowed", - "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_collaborators_only", - "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_contributors_only", - "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_sockpuppet_disallowed", - "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.configure_self_hosted_jit_runner", - "description": "A new just-in-time GitHub Actions self-hosted runner was configured", - "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" - }, - { - "action": "repo.create", - "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "request_category", - "created_at", - "oauth_application_id", - "request_method", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" - }, - { - "action": "repo.create_actions_secret", - "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.create_actions_variable", - "description": "A GitHub Actions variable was created for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.create_integration_secret", - "description": "A Codespaces or Dependabot secret was created for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.destroy", - "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "request_category", - "visibility", - "created_at", - "request_method", - "oauth_application_id", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" - }, - { - "action": "repo.download_zip", - "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives" - }, - { - "action": "repo.pages_cname", - "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "cname", - "created_at", - "operation_type", - "old_cname" - ] - }, - { - "action": "repo.pages_create", - "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_destroy", - "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "repo.pages_https_redirect_disabled", - "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_https_redirect_enabled", - "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "repo.pages_private", - "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_public", - "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_soft_delete", - "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.pages_soft_delete_restore", - "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.pages_source", - "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "visibility", - "created_at" - ] - }, - { - "action": "repo.register_self_hosted_runner", - "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "repo.remove_actions_secret", - "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.remove_actions_variable", - "description": "A GitHub Actions variable was deleted for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.remove_integration_secret", - "description": "A Codespaces or Dependabot secret was deleted for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.remove_member", - "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "Removing a collaborator from a personal repository" - }, - { - "action": "repo.remove_self_hosted_runner", - "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Removing self-hosted runners" - }, - { - "action": "repo.remove_topic", - "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "topic", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.rename", - "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_name", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" - }, - { - "action": "repo.rename_branch", - "description": "A branch was renamed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_branch", - "new_branch", - "default_branch", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch" - }, - { - "action": "repo.restore", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.self_hosted_runner_offline", - "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "repo.self_hosted_runner_online", - "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners" - }, - { - "action": "repo.self_hosted_runner_updated", - "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "runner_id", - "runner_name", - "source_version", - "target_version", - "runner_group_id", - "runner_group_name" - ], - "docs_reference_titles": "Self-hosted runners" - }, - { - "action": "repo.set_actions_fork_pr_approvals_policy", - "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" - }, - { - "action": "repo.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" - }, - { - "action": "repo.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" - }, - { - "action": "repo.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" - }, - { - "action": "repo.set_fork_pr_workflows_policy", - "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" - }, - { - "action": "repo.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" - }, - { - "action": "repo.staff_unlock", - "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.transfer", - "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "old_user", - "operation_type", - "created_at", - "visibility", - "repo_was" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" - }, - { - "action": "repo.transfer_outgoing", - "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "new_nwo", - "visibility", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "repo.transfer_start", - "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility" - ] - }, - { - "action": "repo.unarchived", - "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository" - }, - { - "action": "repo.update_actions_access_settings", - "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "old_policy", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.update_actions_secret", - "description": "A GitHub Actions secret was updated for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.update_actions_settings", - "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "new_policy", - "old_policy", - "updated_access_policy", - "actor_is_bot" - ] - }, - { - "action": "repo.update_actions_variable", - "description": "A GitHub Actions variable was updated for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.update_default_branch", - "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "repo.update_integration_secret", - "description": "A Codespaces or Dependabot secret was updated for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.update_member", - "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "visibility", - "old_permission", - "old_base_role", - "old_repo_permission", - "old_repo_base_role", - "new_repo_base_role", - "new_repo_permission", - "actor_is_bot" - ] - }, - { - "action": "repository_advisory.close", - "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "About repository security advisories" - }, - { - "action": "repository_advisory.cve_request", - "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repository_advisory.github_broadcast", - "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repository_advisory.github_withdraw", - "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_advisory.open", - "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repository_advisory.publish", - "description": "Someone published a security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repository_advisory.reopen", - "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repository_advisory.update", - "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_branch_protection_evaluation.disable", - "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" - }, - { - "action": "repository_branch_protection_evaluation.enable", - "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" - }, - { - "action": "repository_content_analysis.disable", - "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" - }, - { - "action": "repository_content_analysis.enable", - "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" - }, - { - "action": "repository_dependency_graph.disable", - "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" - }, - { - "action": "repository_dependency_graph.enable", - "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo", - "actor_is_bot" - ] - }, - { - "action": "repository_image.create", - "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "content_type" - ] - }, - { - "action": "repository_image.destroy", - "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "content_type", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_invitation.accept", - "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "invitee", - "operation_type", - "inviter" - ] - }, - { - "action": "repository_invitation.cancel", - "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "inviter", - "operation_type", - "invitee", - "created_at" - ] - }, - { - "action": "repository_invitation.create", - "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitee", - "inviter", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_invitation.reject", - "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitee", - "operation_type", - "created_at", - "inviter" - ] - }, - { - "action": "repository_projects_change.clear", - "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for projects in your enterprise" - }, - { - "action": "repository_projects_change.disable", - "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_projects_change.enable", - "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_ruleset.create", - "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules", - "ruleset_conditions", - "ruleset_bypass_actors" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" - }, - { - "action": "repository_ruleset.destroy", - "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules", - "ruleset_bypass_actors" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" - }, - { - "action": "repository_ruleset.update", - "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules_updated", - "ruleset_conditions_added", - "ruleset_conditions_deleted", - "ruleset_old_enforcement", - "ruleset_rules_added", - "ruleset_rules_deleted", - "ruleset_old_name", - "ruleset_conditions_updated", - "ruleset_bypass_actors_added", - "ruleset_bypass_actors_deleted", - "ruleset_bypass_actors_updated", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" - }, - { - "action": "repository_secret_scanning_automatic_validity_checks.disabled", - "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" - }, - { - "action": "repository_secret_scanning_automatic_validity_checks.enabled", - "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" - }, - { - "action": "repository_secret_scanning_custom_pattern.create", - "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern.delete", - "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern.publish", - "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", - "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", - "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning_custom_pattern.update", - "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "Defining custom patterns for secret scanning" - }, - { - "action": "repository_secret_scanning.disable", - "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "repository_secret_scanning.enable", - "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_secret_scanning_generic_secrets.disabled", - "description": "Generic secrets have been disabled at the repository level", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "repository_secret_scanning_generic_secrets.enabled", - "description": "Generic secrets have been enabled at the repository level", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "repository_secret_scanning_non_provider_patterns.disabled", - "description": "Secret scanning for non-provider patterns was disabled at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "repository_secret_scanning_non_provider_patterns.enabled", - "description": "Secret scanning for non-provider patterns was enabled at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Supported secret scanning patterns" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.add", - "description": "A role or team was added to the push protection bypass list at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.disable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.enable", - "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection_bypass_list.remove", - "description": "A role or team was removed from the push protection bypass list at the repository level.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection.disable", - "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_secret_scanning_push_protection.enable", - "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "repository_visibility_change.clear", - "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise" - }, - { - "action": "repository_visibility_change.disable", - "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_visibility_change.enable", - "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repository_vulnerability_alert.auto_dismiss", - "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "alert_id", - "alert_number", - "ghsa_id", - "public_repo", - "owner", - "created_at", - "operation_type", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name" - ], - "docs_reference_titles": "About Dependabot auto-triage rules" - }, - { - "action": "repository_vulnerability_alert.auto_reopen", - "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "alert_id", - "alert_number", - "ghsa_id", - "public_repo", - "owner", - "created_at", - "operation_type", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name" - ], - "docs_reference_titles": "About Dependabot auto-triage rules" - }, - { - "action": "repository_vulnerability_alert.create", - "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "alert_id", - "created_at", - "alert_number" - ], - "docs_reference_titles": "About Dependabot alerts" - }, - { - "action": "repository_vulnerability_alert.dismiss", - "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "alert_id", - "created_at", - "dismiss_reason", - "dismiss_comment", - "alert_number", - "actor_is_bot" - ] - }, - { - "action": "repository_vulnerability_alert.reintroduce", - "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "alert_id", - "created_at", - "public_repo", - "owner", - "operation_type", - "alert_number" - ] - }, - { - "action": "repository_vulnerability_alert.reopen", - "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "alert_id", - "created_at", - "owner", - "operation_type", - "public_repo", - "alert_number" - ] - }, - { - "action": "repository_vulnerability_alert.resolve", - "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "alert_id", - "operation_type", - "created_at", - "alert_number" - ] - }, - { - "action": "repository_vulnerability_alerts.authorized_users_teams", - "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" - }, - { - "action": "repository_vulnerability_alerts_auto_dismissal.disable", - "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_vulnerability_alerts_auto_dismissal.enable", - "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "repository_vulnerability_alerts.disable", - "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_vulnerability_alerts.enable", - "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "required_status_check.create", - "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "context", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" - }, - { - "action": "required_status_check.destroy", - "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "context", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" - }, - { - "action": "restrict_notification_delivery.disable", - "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" - }, - { - "action": "restrict_notification_delivery.enable", - "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise" - }, - { - "action": "role.create", - "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "owner", - "base_role", - "operation_type", - "role_permissions", - "old_role_permissions" - ], - "docs_reference_titles": "Managing custom repository roles for an organization" - }, - { - "action": "role.destroy", - "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "owner", - "role_permissions", - "base_role", - "operation_type" - ], - "docs_reference_titles": "Managing custom repository roles for an organization" - }, - { - "action": "role.update", - "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "role_permissions", - "base_role", - "operation_type", - "created_at", - "old_role_permissions", - "old_base_role" - ], - "docs_reference_titles": "Managing custom repository roles for an organization" - }, - { - "action": "secret_scanning_alert.create", - "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo" - ], - "docs_reference_titles": "Manage secret scanning alerts" - }, - { - "action": "secret_scanning_alert.reopen", - "description": "A secret scanning alert was reopened.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "secret_type_display_name" - ] - }, - { - "action": "secret_scanning_alert.resolve", - "description": "A secret scanning alert was resolved.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "resolution", - "public_repo", - "created_at", - "operation_type", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo" - ] - }, - { - "action": "secret_scanning_alert.revoke", - "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "secret_scanning_alert.validate", - "description": "A secret scanning alert was validated.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "created_at", - "previous_validity", - "current_validity", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo" - ], - "docs_reference_titles": "Manage secret scanning alerts" - }, - { - "action": "secret_scanning.disable", - "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning.enable", - "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_new_repos.disable", - "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_new_repos.enable", - "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "About secret scanning" - }, - { - "action": "secret_scanning_push_protection.bypass", - "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "created_at", - "push_protection_bypass_reason", - "secret_type", - "secret_type_display_name", - "publicly_leaked", - "multi_repo", - "request_reviewer", - "request_reviewer_id" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "secret_scanning_push_protection_request.approve", - "description": "A request to bypass secret scanning push protection was approved by a user.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "secret_scanning_push_protection_request.deny", - "description": "A request to bypass secret scanning push protection was denied by a user.", - "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot", - "request_reviewer_comment" - ], - "docs_reference_titles": "About push protection" - }, - { - "action": "secret_scanning_push_protection_request.request", - "description": "A user requested to bypass secret scanning push protection.", - "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "number", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line" - }, - { - "action": "sponsors.agreement_sign", - "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.custom_amount_settings_change", - "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" - }, - { - "action": "sponsors.fiscal_host_change", - "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.invoiced_agreement_sign", - "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice" - }, - { - "action": "sponsors.repo_funding_links_file_action", - "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" - }, - { - "action": "sponsors.sponsor_sponsorship_cancel", - "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Downgrading a sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_create", - "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" - }, - { - "action": "sponsors.sponsor_sponsorship_payment_complete", - "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "active", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" - }, - { - "action": "sponsors.sponsor_sponsorship_preference_change", - "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_tier_change", - "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" - }, - { - "action": "sponsors.sponsored_developer_approve", - "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_create", - "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_disable", - "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "operation_type", - "created_at" - ] - }, - { - "action": "sponsors.sponsored_developer_profile_update", - "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" - }, - { - "action": "sponsors.sponsored_developer_redraft", - "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.sponsored_developer_request_approval", - "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_tier_description_update", - "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" - }, - { - "action": "sponsors.sponsors_patreon_user_create", - "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "patreon_email", - "patreon_username", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" - }, - { - "action": "sponsors.sponsors_patreon_user_destroy", - "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "patreon_email", - "patreon_username", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Unlinking your Patreon account from GitHub" - }, - { - "action": "sponsors.update_tier_repository", - "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.update_tier_welcome_message", - "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.withdraw_agreement_signature", - "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "ssh_certificate_authority.create", - "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "fingerprint", - "operation_type", - "openssh_public_key", - "created_at" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "ssh_certificate_authority.destroy", - "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "fingerprint", - "operation_type", - "openssh_public_key" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "ssh_certificate_requirement.disable", - "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "ssh_certificate_requirement.enable", - "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise" - }, - { - "action": "staff.dependabot_debug_credentials_generated", - "description": "Dependabot encrypted config was read.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "staff.set_domain_token_expiration", - "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner_type", - "domain_name", - "token_expires_at", - "owner", - "operation_type", - "created_at" - ] - }, - { - "action": "staff.unverify_domain", - "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "owner_type", - "domain_name", - "owner", - "operation_type" - ] - }, - { - "action": "staff.verify_domain", - "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "domain_name", - "operation_type", - "created_at" - ] - }, - { - "action": "team.add_member", - "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type", - "team_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" - }, - { - "action": "team.add_repository", - "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "team.change_parent_team", - "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "team", - "operation_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" - }, - { - "action": "team.change_privacy", - "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "created_at", - "operation_type", - "team_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility" - }, - { - "action": "team.create", - "description": "A new team is created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "team", - "created_at", - "team_type" - ] - }, - { - "action": "team.demote_maintainer", - "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" - }, - { - "action": "team.destroy", - "description": "A team was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "team", - "operation_type", - "team_type" - ] - }, - { - "action": "team_discussions.clear", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "team_discussions.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "team_discussions.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "team_group_mapping.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "team" - ] - }, - { - "action": "team_group_mapping.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "team", - "created_at" - ] - }, - { - "action": "team_group_mapping.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "operation_type", - "created_at" - ] - }, - { - "action": "team.promote_maintainer", - "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" - }, - { - "action": "team.remove_member", - "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "team", - "team_type" - ], - "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" - }, - { - "action": "team.remove_repository", - "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "team", - "operation_type" - ] - }, - { - "action": "team.rename", - "description": "A team's name was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "team", - "operation_type", - "team_type" - ] - }, - { - "action": "team_sync_tenant.disabled", - "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" - }, - { - "action": "team_sync_tenant.enabled", - "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise" - }, - { - "action": "team_sync_tenant.update_okta_credentials", - "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "team.update_repository_permission", - "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "team", - "old_permission", - "operation_type", - "created_at", - "permission", - "new_repo_permission", - "new_repo_base_role", - "old_repo_permission", - "old_repo_base_role" - ] - }, - { - "action": "vulnerability_alert_rule.create", - "description": "A Dependabot rule was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "created_at", - "operation_type" - ] - }, - { - "action": "vulnerability_alert_rule.delete", - "description": "A Dependabot rule was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "created_at", - "operation_type" - ] - }, - { - "action": "vulnerability_alert_rule.disable", - "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "vulnerability_alert_rule.enable", - "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "vulnerability_alert_rule.force_disable", - "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "created_at", - "operation_type" - ] - }, - { - "action": "vulnerability_alert_rule.force_enable", - "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "created_at", - "operation_type" - ] - }, - { - "action": "vulnerability_alert_rule.update", - "description": "A Dependabot rule's conditions, actions, or metadata changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "vulnerability_alert_rule_id", - "vulnerability_alert_rule_name", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Reviewing deployments" - }, - { - "action": "workflows.bypass_protection_rules", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.cancel_workflow_run", - "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "run_number", - "cancelled_at", - "workflow_id", - "operation_type", - "trigger_id", - "public_repo" - ], - "docs_reference_titles": "Canceling a workflow run" - }, - { - "action": "workflows.comment_workflow_job", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.completed_workflow_run", - "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "completed_at", - "conclusion", - "run_number", - "workflow_id", - "operation_type", - "trigger_id", - "run_attempt", - "actor_is_bot", - "actor_is_agent" - ], - "docs_reference_titles": "Viewing workflow run history" - }, - { - "action": "workflows.created_workflow_run", - "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "workflow_id", - "operation_type", - "trigger_id", - "public_repo", - "actor_is_bot", - "actor_is_agent" - ], - "docs_reference_titles": "Understanding GitHub Actions" - }, - { - "action": "workflows.delete_workflow_run", - "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "workflow_run_id", - "started_at", - "head_branch", - "head_sha", - "trigger_id" - ], - "docs_reference_titles": "Deleting a workflow run" - }, - { - "action": "workflows.disable_workflow", - "description": "A workflow was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_id", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ] - }, - { - "action": "workflows.enable_workflow", - "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_id", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "workflows.pin_workflow", - "description": "A workflow was pinned.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "workflow_id", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "workflows.prepared_workflow_job", - "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "job_name", - "runner_labels", - "is_hosted_runner", - "environment_name", - "secrets_passed", - "operation_type", - "created_at", - "runner_owner_type", - "job_workflow_ref", - "calling_workflow_refs", - "calling_workflow_shas", - "imposer_repo" - ], - "docs_reference_titles": "Events that trigger workflows" - }, - { - "action": "workflows.reject_workflow_job", - "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Reviewing deployments" - }, - { - "action": "workflows.rerun_workflow_run", - "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "started_at", - "event", - "name", - "workflow_run_id", - "head_branch", - "head_sha", - "run_number", - "workflow_id", - "operation_type", - "trigger_id", - "run_attempt", - "rerun_type", - "check_run_id", - "actor_is_bot" - ], - "docs_reference_titles": "Re-running workflows and jobs" - }, - { - "action": "workflows.unpin_workflow", - "description": "A workflow was unpinned after previously being pinned.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "workflow_id", - "created_at", - "operation_type", - "actor_is_bot" - ] - } -] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.14/user.json b/src/audit-logs/data/ghes-3.14/user.json deleted file mode 100644 index 315369a09f99..000000000000 --- a/src/audit-logs/data/ghes-3.14/user.json +++ /dev/null @@ -1,12477 +0,0 @@ -[ - { - "action": "account.billing_date_change", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "account.plan_change", - "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "How GitHub billing works" - }, - { - "action": "account_recovery_token.confirm", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "account_recovery_token.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "account_recovery_token.recover", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "actions_cache.delete", - "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "actions_cache_id", - "actions_cache_key", - "actions_cache_version", - "actions_cache_scope", - "created_at", - "operation_type" - ] - }, - { - "action": "artifact.destroy", - "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "billing.change_billing_type", - "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Managing your payment and billing information" - }, - { - "action": "billing.change_email", - "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "email" - ], - "docs_reference_titles": "Managing your payment and billing information" - }, - { - "action": "billing.lock", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "billing.unlock", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "billing.update_bill_cycle_day", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "business.set_actions_fork_pr_approvals_policy", - "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_fork_pr_workflows_policy", - "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "business.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" - }, - { - "action": "checks.auto_trigger_disabled", - "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" - }, - { - "action": "checks.auto_trigger_enabled", - "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" - }, - { - "action": "checks.delete_logs", - "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "codespaces.allow_permissions", - "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "origin_repository", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.connect", - "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot", - "machine_type", - "devcontainer_path" - ] - }, - { - "action": "codespaces.create", - "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at", - "actor_is_bot", - "machine_type", - "devcontainer_path" - ], - "docs_reference_titles": "Creating a codespace for a repository" - }, - { - "action": "codespaces.destroy", - "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "pull_request_id", - "owner", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Deleting a codespace" - }, - { - "action": "codespaces.export_environment", - "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "owner", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "codespaces.restore", - "description": "A codespace was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.start_environment", - "description": "A codespace was started.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "owner", - "pull_request_id", - "machine_type", - "devcontainer_path", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "codespaces.suspend_environment", - "description": "A codespace was stopped.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "codespaces.trusted_repositories_access_update", - "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "copilot.cfb_seat_added", - "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_created", - "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "What is GitHub Copilot?" - }, - { - "action": "copilot.cfb_seat_assignment_refreshed", - "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_reused", - "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_assignment_unassigned", - "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "copilot.cfb_seat_cancelled", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "seat_assignment" - ] - }, - { - "action": "copilot.cfb_seat_cancelled_by_staff", - "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "custom_hosted_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "dependabot_alerts.disable", - "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" - }, - { - "action": "dependabot_alerts.enable", - "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" - }, - { - "action": "dependabot_alerts_new_repos.disable", - "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_alerts_new_repos.enable", - "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" - }, - { - "action": "dependabot_repository_access.repositories_updated", - "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "dependabot_security_updates.disable", - "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates.enable", - "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "dependabot_security_updates_new_repos.disable", - "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependabot_security_updates_new_repos.enable", - "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "dependency_graph.disable", - "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependency_graph.enable", - "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "dependency_graph_new_repos.disable", - "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" - }, - { - "action": "dependency_graph_new_repos.enable", - "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "environment.add_protection_rule", - "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "environment.create_actions_secret", - "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.create_actions_variable", - "description": "A variable was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "environment_name", - "public_repo", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.delete", - "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.remove_actions_secret", - "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.remove_actions_variable", - "description": "A variable was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.remove_protection_rule", - "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.update_actions_secret", - "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "visibility", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "environment.update_actions_variable", - "description": "A variable was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "environment_name", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "environment.update_protection_rule", - "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "new_value", - "approvers_was", - "approvers", - "can_admins_bypass", - "prevent_self_review" - ], - "docs_reference_titles": "Managing environments for deployment" - }, - { - "action": "gist.create", - "description": "A gist was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "gist_id", - "created_at", - "operation_type", - "visibility" - ] - }, - { - "action": "gist.destroy", - "description": "A gist was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "gist_id", - "visibility", - "created_at", - "operation_type" - ] - }, - { - "action": "gist.visibility_change", - "description": "The visibility of a gist was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "gist_id", - "visibility", - "created_at" - ] - }, - { - "action": "git_signing_ssh_public_key.create", - "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "title", - "key", - "fingerprint", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" - }, - { - "action": "git_signing_ssh_public_key.delete", - "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "title", - "key", - "fingerprint", - "explanation", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" - }, - { - "action": "github_hosted_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "github_hosted_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "github_hosted_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "gpg_key.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "gpg_key.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "hook.active_changed", - "description": "A hook's active status was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "events", - "active", - "active_was", - "hook_id", - "operation_type" - ] - }, - { - "action": "hook.config_changed", - "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "hook_id", - "created_at", - "oauth_application_id", - "events" - ] - }, - { - "action": "hook.create", - "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "hook_id", - "events", - "operation_type", - "name", - "created_at" - ], - "docs_reference_titles": "About webhooks" - }, - { - "action": "hook.destroy", - "description": "A hook was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "events", - "created_at", - "name", - "operation_type", - "oauth_application_id", - "hook_id" - ] - }, - { - "action": "hook.events_changed", - "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "events", - "operation_type", - "name", - "events_were", - "created_at", - "hook_id", - "oauth_application_id" - ] - }, - { - "action": "integration.create", - "description": "A GitHub App was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "integration", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.destroy", - "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "integration.generate_client_secret", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration_installation.create", - "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "name", - "repository_selection", - "created_at", - "integration", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" - }, - { - "action": "integration_installation.destroy", - "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "repository_selection", - "integration", - "operation_type", - "name", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.repositories_added", - "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "repository_selection", - "name", - "integration", - "operation_type", - "repositories_added", - "created_at", - "repositories_added_names", - "actor_is_bot", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" - }, - { - "action": "integration_installation.repositories_removed", - "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "repository_selection", - "repositories_removed", - "integration", - "created_at", - "name", - "repositories_removed_names", - "actor_is_bot", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" - }, - { - "action": "integration_installation.suspend", - "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "repository_selection", - "integration", - "operation_type", - "created_at", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.unsuspend", - "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "repository_selection", - "integration", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" - }, - { - "action": "integration_installation.version_updated", - "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "integration", - "name", - "operation_type", - "created_at", - "repository_selection", - "application_client_id" - ], - "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" - }, - { - "action": "integration.manager_added", - "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "name", - "manager", - "operation_type", - "integration" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" - }, - { - "action": "integration.manager_removed", - "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "integration", - "name", - "created_at", - "manager" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" - }, - { - "action": "integration.remove_client_secret", - "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at" - ] - }, - { - "action": "integration.revoke_all_tokens", - "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.revoke_tokens", - "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "operation_type", - "created_at", - "application_client_id" - ] - }, - { - "action": "integration.suspend", - "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "created_at", - "operation_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" - }, - { - "action": "integration.transfer", - "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "transfer_to_id", - "requester", - "requester_id", - "created_at", - "transfer_to", - "operation_type", - "integration", - "transfer_from", - "transfer_from_id", - "transfer_from_type", - "transfer_to_type" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" - }, - { - "action": "integration.unsuspend", - "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "integration", - "created_at", - "operation_type", - "application_client_id" - ], - "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" - }, - { - "action": "marketplace_agreement_signature.create", - "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.approve", - "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "secondary_category", - "primary_category", - "operation_type", - "created_at", - "marketplace_listing", - "integration" - ] - }, - { - "action": "marketplace_listing.change_category", - "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "marketplace_listing", - "integration", - "secondary_category", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.create", - "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "created_at", - "oauth_application", - "marketplace_listing", - "secondary_category", - "oauth_application_id", - "operation_type" - ] - }, - { - "action": "marketplace_listing.delist", - "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "secondary_category", - "operation_type", - "marketplace_listing", - "primary_category", - "integration" - ] - }, - { - "action": "marketplace_listing_plan.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "marketplace_listing", - "has_free_trial", - "yearly_price_in_cents", - "description", - "bullets", - "monthly_price_in_cents", - "marketplace_listing_plan" - ] - }, - { - "action": "marketplace_listing_plan.publish", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "marketplace_listing_plan", - "marketplace_listing", - "description", - "bullets", - "has_free_trial", - "created_at", - "operation_type", - "monthly_price_in_cents", - "yearly_price_in_cents" - ] - }, - { - "action": "marketplace_listing_plan.retire", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "marketplace_listing_plan", - "description", - "yearly_price_in_cents", - "created_at", - "bullets", - "has_free_trial", - "marketplace_listing", - "monthly_price_in_cents", - "operation_type" - ] - }, - { - "action": "marketplace_listing_plan.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "monthly_price_in_cents", - "marketplace_listing", - "description", - "bullets", - "yearly_price_in_cents", - "has_free_trial", - "marketplace_listing_plan", - "operation_type", - "created_at" - ] - }, - { - "action": "marketplace_listing.redraft", - "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "secondary_category", - "oauth_application_id", - "operation_type", - "oauth_application", - "created_at", - "marketplace_listing", - "primary_category" - ] - }, - { - "action": "marketplace_listing.reject", - "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "primary_category", - "secondary_category", - "marketplace_listing", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "merge_queue.pull_request_dequeued", - "description": "A pull request was removed from a merge queue.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.pull_request_queue_jump", - "description": "A pull request was moved ahead in a merge queue.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.queue_cleared", - "description": "A merge queue was cleared.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "merge_queue.update_settings", - "description": "The settings for a merge queue were updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "max_entries_to_build", - "min_entries_to_merge", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "metered_billing_configuration.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "metered_billing_configuration.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "metered_billing_configuration.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "migration.create", - "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "oauth_access.create", - "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" - }, - { - "action": "oauth_access.destroy", - "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "explanation", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" - }, - { - "action": "oauth_access.regenerate", - "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "oauth_application_name" - ] - }, - { - "action": "oauth_access.update", - "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "oauth_application.create", - "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "oauth_application" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.destroy", - "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "oauth_application" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.generate_client_secret", - "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.remove_client_secret", - "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.reset_secret", - "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "operation_type", - "created_at", - "oauth_application_id" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.revoke_all_tokens", - "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application", - "oauth_application_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.revoke_tokens", - "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "oauth_application", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_application.transfer", - "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "oauth_application", - "oauth_application_id" - ], - "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" - }, - { - "action": "oauth_authorization.create", - "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot", - "oauth_application_name" - ], - "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" - }, - { - "action": "oauth_authorization.destroy", - "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "explanation", - "actor_is_bot", - "oauth_application_name" - ], - "docs_reference_titles": "Reviewing and revoking authorization of GitHub Apps" - }, - { - "action": "org.add_member", - "description": "A user joined an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "org.add_outside_collaborator", - "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "inviter", - "public_repo", - "permission", - "invitee", - "created_at", - "operation_type" - ] - }, - { - "action": "org.advanced_security_disabled_for_new_repos", - "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_disabled_on_all_repos", - "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_enabled_for_new_repos", - "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.advanced_security_enabled_on_all_repos", - "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "org.remove_member", - "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "org.set_actions_fork_pr_approvals_policy", - "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" - }, - { - "action": "org.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" - }, - { - "action": "org.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" - }, - { - "action": "org.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" - }, - { - "action": "org.set_fork_pr_workflows_policy", - "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" - }, - { - "action": "org.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" - }, - { - "action": "org.update_member", - "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "old_permission", - "permission", - "operation_type" - ] - }, - { - "action": "org.update_member_repository_creation_permission", - "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "org.update_member_repository_invitation_permission", - "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "permission", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Setting permissions for adding outside collaborators" - }, - { - "action": "pages_protected_domain.create", - "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.delete", - "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "pages_protected_domain.verify", - "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "owner_type", - "domain", - "state", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" - }, - { - "action": "passkey.register", - "description": "A new passkey was added.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "nickname", - "created_at", - "operation_type" - ] - }, - { - "action": "passkey.remove", - "description": "A new passkey was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "nickname", - "created_at", - "operation_type" - ] - }, - { - "action": "payment_method.create", - "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "payment_method.remove", - "description": "A payment method was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "payment_method.update", - "description": "An existing payment method was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "personal_access_token.access_granted", - "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.access_revoked", - "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.create", - "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ] - }, - { - "action": "personal_access_token.credential_regenerated", - "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "created_at", - "operation_type" - ] - }, - { - "action": "personal_access_token.credential_revoked", - "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" - }, - { - "action": "personal_access_token.destroy", - "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "explanation", - "created_at", - "operation_type" - ] - }, - { - "action": "personal_access_token.request_cancelled", - "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ] - }, - { - "action": "personal_access_token.request_created", - "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_id", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.request_denied", - "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type", - "user_programmatic_access_request_id" - ], - "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" - }, - { - "action": "personal_access_token.update", - "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "user_programmatic_access_name", - "repository_selection", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" - }, - { - "action": "premium_runner.create", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "premium_runner.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "premium_runner.update", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "runner_group_id", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting_new_repos.disable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "private_vulnerability_reporting_new_repos.enable", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "profile_picture.update", - "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "owner", - "operation_type" - ], - "docs_reference_titles": "Personalize your profile" - }, - { - "action": "project.access", - "description": "A project board visibility was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.close", - "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "project_id", - "project_kind" - ], - "docs_reference_titles": "Closing a project (classic)" - }, - { - "action": "project.create", - "description": "A project board was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.delete", - "description": "A project board was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project_field.create", - "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" - }, - { - "action": "project_field.delete", - "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" - }, - { - "action": "project.link", - "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.open", - "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "project_id", - "operation_type", - "created_at", - "project_kind", - "project_name" - ], - "docs_reference_titles": "Reopening a closed project (classic)" - }, - { - "action": "project.rename", - "description": "A project board was renamed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "old_name", - "operation_type" - ] - }, - { - "action": "project.unlink", - "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.update_org_permission", - "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project.update_team_permission", - "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "team" - ] - }, - { - "action": "project.update_user_permission", - "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "project_view.create", - "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "project_view.delete", - "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" - }, - { - "action": "protected_branch.update_merge_queue_enforcement_level", - "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "merge_queue_enforcement_level", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" - }, - { - "action": "public_key.create", - "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "read_only", - "operation_type", - "created_at", - "key", - "fingerprint", - "title" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" - }, - { - "action": "public_key.delete", - "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "fingerprint", - "read_only", - "explanation", - "key", - "operation_type", - "title", - "created_at" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" - }, - { - "action": "public_key.unverification_failure", - "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "title", - "key", - "fingerprint", - "read_only", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.unverify", - "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "title", - "key", - "read_only", - "explanation", - "fingerprint" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.update", - "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "fingerprint", - "read_only", - "operation_type", - "created_at", - "title" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.verification_failure", - "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "fingerprint", - "oauth_application_id", - "title", - "created_at", - "read_only", - "operation_type" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "public_key.verify", - "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "key", - "fingerprint", - "title", - "read_only" - ], - "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" - }, - { - "action": "repo.access", - "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility", - "previous_visibility" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" - }, - { - "action": "repo.actions_enabled", - "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" - }, - { - "action": "repo.add_member", - "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "created_at", - "operation_type", - "oauth_application_id" - ], - "docs_reference_titles": "Inviting collaborators to a personal repository" - }, - { - "action": "repo.add_topic", - "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "topic", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" - }, - { - "action": "repo.advanced_security_disabled", - "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" - }, - { - "action": "repo.advanced_security_enabled", - "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" - }, - { - "action": "repo.archived", - "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository" - }, - { - "action": "repo.change_merge_setting", - "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type", - "public_repo", - "actor_is_bot" - ] - }, - { - "action": "repo.code_scanning_analysis_deleted", - "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at", - "public_repo", - "tool", - "category" - ], - "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" - }, - { - "action": "repo.code_scanning_configuration_for_branch_deleted", - "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "tool", - "branch", - "category", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Resolving code scanning alerts" - }, - { - "action": "repo.config.disable_collaborators_only", - "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.disable_contributors_only", - "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.disable_sockpuppet_disallowed", - "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_collaborators_only", - "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_contributors_only", - "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.config.enable_sockpuppet_disallowed", - "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" - }, - { - "action": "repo.configure_self_hosted_jit_runner", - "description": "A new just-in-time GitHub Actions self-hosted runner was configured", - "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" - }, - { - "action": "repo.create", - "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "request_category", - "created_at", - "oauth_application_id", - "request_method", - "public_repo", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" - }, - { - "action": "repo.create_actions_secret", - "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.create_actions_variable", - "description": "A GitHub Actions variable was created for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.create_integration_secret", - "description": "A Codespaces or Dependabot secret was created for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.destroy", - "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "request_category", - "visibility", - "created_at", - "request_method", - "oauth_application_id", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" - }, - { - "action": "repo.pages_cname", - "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "cname", - "created_at", - "operation_type", - "old_cname" - ] - }, - { - "action": "repo.pages_create", - "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_destroy", - "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "repo.pages_https_redirect_disabled", - "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_https_redirect_enabled", - "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "visibility", - "operation_type" - ] - }, - { - "action": "repo.pages_private", - "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_public", - "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.pages_soft_delete", - "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.pages_soft_delete_restore", - "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.pages_source", - "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "visibility", - "created_at" - ] - }, - { - "action": "repo.register_self_hosted_runner", - "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Adding self-hosted runners" - }, - { - "action": "repo.remove_actions_secret", - "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.remove_actions_variable", - "description": "A GitHub Actions variable was deleted for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.remove_integration_secret", - "description": "A Codespaces or Dependabot secret was deleted for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.remove_member", - "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "Removing a collaborator from a personal repository" - }, - { - "action": "repo.remove_self_hosted_runner", - "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Removing self-hosted runners" - }, - { - "action": "repo.remove_topic", - "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "topic", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.rename", - "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_name", - "created_at", - "operation_type", - "visibility" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" - }, - { - "action": "repo.restore", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "repo.set_actions_fork_pr_approvals_policy", - "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "created_at", - "operation_type", - "public_repo" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" - }, - { - "action": "repo.set_actions_private_fork_pr_approvals_policy", - "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" - }, - { - "action": "repo.set_actions_retention_limit", - "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "limit", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" - }, - { - "action": "repo.set_default_workflow_permissions", - "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" - }, - { - "action": "repo.set_fork_pr_workflows_policy", - "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" - }, - { - "action": "repo.set_workflow_permission_can_approve_pr", - "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" - }, - { - "action": "repo.staff_unlock", - "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.temporary_access_granted", - "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Accessing user-owned repositories in your enterprise" - }, - { - "action": "repo.transfer", - "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "owner", - "old_user", - "operation_type", - "created_at", - "visibility", - "repo_was" - ], - "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" - }, - { - "action": "repo.transfer_outgoing", - "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "new_nwo", - "visibility", - "created_at", - "operation_type", - "public_repo" - ] - }, - { - "action": "repo.transfer_start", - "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility" - ] - }, - { - "action": "repo.unarchived", - "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "visibility" - ], - "docs_reference_titles": "/repositories/archiving-a-github-repository" - }, - { - "action": "repo.update_actions_access_settings", - "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "policy", - "old_policy", - "created_at", - "operation_type" - ] - }, - { - "action": "repo.update_actions_secret", - "description": "A GitHub Actions secret was updated for a repository.", - "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "key", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Using secrets in GitHub Actions" - }, - { - "action": "repo.update_actions_settings", - "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "new_policy", - "old_policy", - "updated_access_policy", - "actor_is_bot" - ] - }, - { - "action": "repo.update_actions_variable", - "description": "A GitHub Actions variable was updated for a repository.", - "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "public_repo", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Store information in variables" - }, - { - "action": "repo.update_default_branch", - "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "visibility", - "operation_type", - "created_at", - "actor_is_bot" - ] - }, - { - "action": "repo.update_integration_secret", - "description": "A Codespaces or Dependabot secret was updated for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "repo.update_member", - "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type", - "visibility", - "old_permission", - "old_base_role", - "old_repo_permission", - "old_repo_base_role", - "new_repo_base_role", - "new_repo_permission", - "actor_is_bot" - ] - }, - { - "action": "repository_image.create", - "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "content_type" - ] - }, - { - "action": "repository_image.destroy", - "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "content_type", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_invitation.accept", - "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "invitee", - "operation_type", - "inviter" - ] - }, - { - "action": "repository_invitation.cancel", - "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "inviter", - "operation_type", - "invitee", - "created_at" - ] - }, - { - "action": "repository_invitation.create", - "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitee", - "inviter", - "created_at", - "operation_type" - ] - }, - { - "action": "repository_invitation.reject", - "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "invitee", - "operation_type", - "created_at", - "inviter" - ] - }, - { - "action": "repository_ruleset.create", - "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules", - "ruleset_conditions", - "ruleset_bypass_actors" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" - }, - { - "action": "repository_ruleset.destroy", - "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules", - "ruleset_bypass_actors" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" - }, - { - "action": "repository_ruleset.update", - "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_name", - "public_repo", - "created_at", - "operation_type", - "ruleset_id", - "ruleset_name", - "ruleset_enforcement", - "ruleset_source_type", - "ruleset_rules_updated", - "ruleset_conditions_added", - "ruleset_conditions_deleted", - "ruleset_old_enforcement", - "ruleset_rules_added", - "ruleset_rules_deleted", - "ruleset_old_name", - "ruleset_conditions_updated", - "ruleset_bypass_actors_added", - "ruleset_bypass_actors_deleted", - "ruleset_bypass_actors_updated", - "actor_is_bot" - ], - "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" - }, - { - "action": "security_key.register", - "description": "A security key was registered for an account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "security_key.remove", - "description": "A security key was removed from an account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "sponsors.agreement_sign", - "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.custom_amount_settings_change", - "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" - }, - { - "action": "sponsors.fiscal_host_change", - "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.repo_funding_links_file_action", - "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" - }, - { - "action": "sponsors.sponsor_sponsorship_cancel", - "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Downgrading a sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_create", - "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" - }, - { - "action": "sponsors.sponsor_sponsorship_payment_complete", - "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "active", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" - }, - { - "action": "sponsors.sponsor_sponsorship_preference_change", - "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" - }, - { - "action": "sponsors.sponsor_sponsorship_tier_change", - "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" - }, - { - "action": "sponsors.sponsored_developer_approve", - "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_create", - "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_disable", - "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "operation_type", - "created_at" - ] - }, - { - "action": "sponsors.sponsored_developer_profile_update", - "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" - }, - { - "action": "sponsors.sponsored_developer_redraft", - "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.sponsored_developer_request_approval", - "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.sponsored_developer_tier_description_update", - "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" - }, - { - "action": "sponsors.sponsored_developer_update_newsletter_send", - "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" - }, - { - "action": "sponsors.sponsors_patreon_user_create", - "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "patreon_email", - "patreon_username", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" - }, - { - "action": "sponsors.sponsors_patreon_user_destroy", - "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "patreon_email", - "patreon_username", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Unlinking your Patreon account from GitHub" - }, - { - "action": "sponsors.update_tier_repository", - "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.update_tier_welcome_message", - "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "sponsors.waitlist_join", - "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" - }, - { - "action": "sponsors.withdraw_agreement_signature", - "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "sponsors_listing_id", - "created_at", - "operation_type" - ] - }, - { - "action": "successor_invitation.accept", - "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.cancel", - "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.create", - "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.decline", - "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "successor_invitation.destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "successor_invitation.revoke", - "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" - }, - { - "action": "trusted_device.register", - "description": "A new trusted device was added.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "trusted_device.remove", - "description": "A trusted device was removed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_account_recovery.abort", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.complete", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.ignore", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.staff_approve", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "two_factor_account_recovery.staff_decline", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_account_recovery.start", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_account_recovery.two_factor_destroy", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.add_factor", - "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" - }, - { - "action": "two_factor_authentication.disabled", - "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Disabling two-factor authentication for your personal account" - }, - { - "action": "two_factor_authentication.enabled", - "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Configuring two-factor authentication" - }, - { - "action": "two_factor_authentication.password_reset_fallback_sms", - "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.recovery_codes_regenerated", - "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.remove_factor", - "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" - }, - { - "action": "two_factor_authentication.sign_in_fallback_sms", - "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "two_factor_authentication.update_fallback", - "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.add_email", - "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "email", - "created_at" - ], - "docs_reference_titles": "Adding an email address to your GitHub account" - }, - { - "action": "user.async_delete", - "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.audit_log_export", - "description": "Audit log entries were exported.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.block_user", - "description": "A user was blocked by another user.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "blocked_user", - "operation_type", - "created_at" - ] - }, - { - "action": "user.change_password", - "description": "A user changed their password.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.codespaces_trusted_repo_access_granted", - "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "user.codespaces_trusted_repo_access_revoked", - "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Managing access to other repositories within your codespace" - }, - { - "action": "user.create", - "description": "A new user account was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "email", - "operation_type", - "created_at" - ] - }, - { - "action": "user.create_integration_secret", - "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "created_at", - "operation_type" - ] - }, - { - "action": "user.creation_rate_limit_exceeded", - "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "oauth_application_id" - ] - }, - { - "action": "user.delete", - "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.demote", - "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "created_at", - "operation_type" - ] - }, - { - "action": "user.destroy", - "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.device_verification_failure", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.device_verification_requested", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.device_verification_success", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.disable_collaborators_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.disable_contributors_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.disable_sockpuppet_disallowed", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user_email.confirm_claim", - "description": "An enterprise managed user claimed an email address.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "user_email.mark_as_unclaimed", - "description": "N/A", - "docs_reference_links": "An enterprise managed user unclaimed an email address.", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ], - "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." - }, - { - "action": "user.enable_collaborators_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.enable_contributors_only", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.enable_sockpuppet_disallowed", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.failed_login", - "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.forgot_password", - "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "email", - "created_at" - ], - "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" - }, - { - "action": "user.grant_github_developer", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.hide_private_contributions_count", - "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "Manage visibility settings for private contributions" - }, - { - "action": "user.login", - "description": "A user signed in.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "passkey_nickname" - ] - }, - { - "action": "user.logout", - "description": "A user signed out.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.new_device_used", - "description": "A user signed in from a new device.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.promote", - "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "oauth_application_id", - "operation_type" - ] - }, - { - "action": "user.recreate", - "description": "A user's account was restored.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.remove_email", - "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "email" - ] - }, - { - "action": "user.remove_integration_secret", - "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "integration", - "created_at", - "operation_type" - ] - }, - { - "action": "user.rename", - "description": "A username was changed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "old_login", - "created_at", - "operation_type" - ] - }, - { - "action": "user.reset_password", - "description": "A user reset their account password.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user_session.country_change", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.show_private_contributions_count", - "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ], - "docs_reference_titles": "Manage visibility settings for private contributions" - }, - { - "action": "user.sign_in_from_unrecognized_device", - "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.sign_in_from_unrecognized_device_and_location", - "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user_status.destroy", - "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "message", - "created_at", - "limited_availability", - "emoji", - "operation_type" - ] - }, - { - "action": "user_status.update", - "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "limited_availability", - "message", - "created_at", - "emoji", - "operation_type" - ], - "docs_reference_titles": "Personalize your profile" - }, - { - "action": "user.suspend", - "description": "A user account was suspended.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "user.toggle_warn_private_email", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_challenge_failure", - "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_challenge_success", - "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recover", - "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recovery_codes_downloaded", - "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recovery_codes_printed", - "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at" - ] - }, - { - "action": "user.two_factor_recovery_codes_viewed", - "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "user.two_factor_requested", - "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ], - "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" - }, - { - "action": "user.unblock_user", - "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "blocked_user", - "operation_type", - "created_at" - ] - }, - { - "action": "user.unsuspend", - "description": "A user account was unsuspended.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "oauth_application_id", - "operation_type", - "created_at" - ] - }, - { - "action": "user.update_integration_secret", - "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "key", - "visibility", - "integration", - "created_at", - "operation_type" - ] - }, - { - "action": "user.update_new_repository_default_branch_setting", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.approve_workflow_job", - "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Reviewing deployments" - }, - { - "action": "workflows.bypass_protection_rules", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.comment_workflow_job", - "description": "N/A", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "public_repo", - "created_at", - "operation_type" - ] - }, - { - "action": "workflows.delete_workflow_run", - "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "operation_type", - "created_at", - "workflow_run_id", - "started_at", - "head_branch", - "head_sha", - "trigger_id" - ], - "docs_reference_titles": "Deleting a workflow run" - }, - { - "action": "workflows.disable_workflow", - "description": "A workflow was disabled.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_id", - "operation_type", - "created_at", - "public_repo", - "actor_is_bot" - ] - }, - { - "action": "workflows.enable_workflow", - "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_id", - "operation_type", - "created_at", - "public_repo" - ] - }, - { - "action": "workflows.pin_workflow", - "description": "A workflow was pinned.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "workflow_id", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "workflows.reject_workflow_job", - "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "workflow_run_id", - "run_number", - "operation_type", - "created_at", - "public_repo" - ], - "docs_reference_titles": "Reviewing deployments" - }, - { - "action": "workflows.unpin_workflow", - "description": "A workflow was unpinned after previously being pinned.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "public_repo", - "workflow_id", - "created_at", - "operation_type", - "actor_is_bot" - ] - } -] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.16/enterprise.json b/src/audit-logs/data/ghes-3.16/enterprise.json index d929e640847c..b375589a5fee 100644 --- a/src/audit-logs/data/ghes-3.16/enterprise.json +++ b/src/audit-logs/data/ghes-3.16/enterprise.json @@ -9820,70 +9820,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.16/organization.json b/src/audit-logs/data/ghes-3.16/organization.json index d15c243f0076..a2f663469d77 100644 --- a/src/audit-logs/data/ghes-3.16/organization.json +++ b/src/audit-logs/data/ghes-3.16/organization.json @@ -7127,70 +7127,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.17/enterprise.json b/src/audit-logs/data/ghes-3.17/enterprise.json index 0dfc5eca0cca..78a8dccf4aa1 100644 --- a/src/audit-logs/data/ghes-3.17/enterprise.json +++ b/src/audit-logs/data/ghes-3.17/enterprise.json @@ -10196,70 +10196,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.17/organization.json b/src/audit-logs/data/ghes-3.17/organization.json index bfe4d0f647c9..d81e69fc44db 100644 --- a/src/audit-logs/data/ghes-3.17/organization.json +++ b/src/audit-logs/data/ghes-3.17/organization.json @@ -7429,70 +7429,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.18/enterprise.json b/src/audit-logs/data/ghes-3.18/enterprise.json index 1a6c3e5b85ba..2f4032df5ebd 100644 --- a/src/audit-logs/data/ghes-3.18/enterprise.json +++ b/src/audit-logs/data/ghes-3.18/enterprise.json @@ -10266,70 +10266,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.18/organization.json b/src/audit-logs/data/ghes-3.18/organization.json index b4e0f4bf20f4..9d991afc43fc 100644 --- a/src/audit-logs/data/ghes-3.18/organization.json +++ b/src/audit-logs/data/ghes-3.18/organization.json @@ -7676,70 +7676,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.19/enterprise.json b/src/audit-logs/data/ghes-3.19/enterprise.json index cd65c8c3bcfc..4df509edf298 100644 --- a/src/audit-logs/data/ghes-3.19/enterprise.json +++ b/src/audit-logs/data/ghes-3.19/enterprise.json @@ -10900,70 +10900,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.19/organization.json b/src/audit-logs/data/ghes-3.19/organization.json index 94e6c821a22c..bca9a64e7c77 100644 --- a/src/audit-logs/data/ghes-3.19/organization.json +++ b/src/audit-logs/data/ghes-3.19/organization.json @@ -8028,70 +8028,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.code_security_metered_usage_lock", "description": "Enablement for Code Security features on new repositories has been locked for this organization.", diff --git a/src/audit-logs/data/ghes-3.20/enterprise.json b/src/audit-logs/data/ghes-3.20/enterprise.json index 3da2d61e7e09..9731c694a2f7 100644 --- a/src/audit-logs/data/ghes-3.20/enterprise.json +++ b/src/audit-logs/data/ghes-3.20/enterprise.json @@ -10933,70 +10933,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.20/organization.json b/src/audit-logs/data/ghes-3.20/organization.json index cefd575d70f4..9f97bf91b246 100644 --- a/src/audit-logs/data/ghes-3.20/organization.json +++ b/src/audit-logs/data/ghes-3.20/organization.json @@ -7965,70 +7965,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.code_security_metered_usage_lock", "description": "Enablement for Code Security features on new repositories has been locked for this organization.", diff --git a/src/audit-logs/data/ghes-3.21/enterprise.json b/src/audit-logs/data/ghes-3.21/enterprise.json index 3da2d61e7e09..9731c694a2f7 100644 --- a/src/audit-logs/data/ghes-3.21/enterprise.json +++ b/src/audit-logs/data/ghes-3.21/enterprise.json @@ -10933,70 +10933,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", diff --git a/src/audit-logs/data/ghes-3.21/organization.json b/src/audit-logs/data/ghes-3.21/organization.json index cefd575d70f4..9f97bf91b246 100644 --- a/src/audit-logs/data/ghes-3.21/organization.json +++ b/src/audit-logs/data/ghes-3.21/organization.json @@ -7965,70 +7965,6 @@ "actor_is_bot" ] }, - { - "action": "org.code_scanning_scan_inactive_repos_disabled", - "description": "Scanning inactive repositories was disabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, - { - "action": "org.code_scanning_scan_inactive_repos_enabled", - "description": "Scanning inactive repositories was enabled for an organization.", - "docs_reference_links": "N/A", - "fields": [ - "@timestamp", - "_document_id", - "action", - "actor", - "actor_id", - "business", - "business_id", - "hashed_token", - "org", - "org_id", - "programmatic_access_type", - "repo", - "repo_id", - "repository", - "repository_id", - "request_access_security_header", - "request_id", - "token_id", - "token_scopes", - "user", - "user_id", - "user_agent", - "created_at", - "operation_type", - "actor_is_bot" - ] - }, { "action": "org.code_security_metered_usage_lock", "description": "Enablement for Code Security features on new repositories has been locked for this organization.", diff --git a/src/audit-logs/lib/config.json b/src/audit-logs/lib/config.json index 01917f4681b7..eb5bb7ebadbf 100644 --- a/src/audit-logs/lib/config.json +++ b/src/audit-logs/lib/config.json @@ -9,5 +9,5 @@ "git": "Note: Git events have special access requirements and retention policies that differ from other audit log events. For GitHub Enterprise Cloud, access Git events via the REST API only with 7-day retention. For GitHub Enterprise Server, Git events must be enabled in audit log configuration and are not included in search results.", "sso_redirect": "Note: Automatically redirecting users to sign in is currently in beta for Enterprise Managed Users and subject to change." }, - "sha": "821017c047d1107e7ba7c68f5bdbdf2c58473190" + "sha": "c109f73d3ff5cbc8a7aee930bb5524aaf7e79501" } \ No newline at end of file diff --git a/src/code-tabs/lib/languages.ts b/src/code-tabs/lib/languages.ts new file mode 100644 index 000000000000..13e91c3c21bc --- /dev/null +++ b/src/code-tabs/lib/languages.ts @@ -0,0 +1,11 @@ +export const codeLanguages: Record = { + typescript: 'TypeScript', + python: 'Python', + go: 'Go', + csharp: 'C#', + java: 'Java', + ruby: 'Ruby', + shell: 'Shell', + javascript: 'JavaScript', + dotnet: '.NET', +} diff --git a/src/content-pipelines/state/copilot-cli.sha b/src/content-pipelines/state/copilot-cli.sha index 2b6216466223..7768624e01b7 100644 --- a/src/content-pipelines/state/copilot-cli.sha +++ b/src/content-pipelines/state/copilot-cli.sha @@ -1 +1 @@ -cdbdb2fa932abc3687ab433aa87345d6f004ad85 +e7ee4ef1f3d09323d60d202f335cc24f94d71fa9 diff --git a/src/content-render/liquid/codetabs.ts b/src/content-render/liquid/codetabs.ts new file mode 100644 index 000000000000..95854a753740 --- /dev/null +++ b/src/content-render/liquid/codetabs.ts @@ -0,0 +1,127 @@ +import { encode } from 'html-entities' +import { TokenizationError, type TagToken, type TopLevelToken } from 'liquidjs' + +import { codeLanguages } from '@/code-tabs/lib/languages' + +interface LiquidTemplate { + [key: string]: unknown +} + +interface LiquidStream { + on(event: string, callback: (template?: LiquidTemplate) => void): LiquidStream + stop(): void + start(): void +} + +interface LiquidEngine { + parser: { + parseStream(tokens: TopLevelToken[]): LiquidStream + } + renderer: { + renderTemplates(templates: LiquidTemplate[], scope: Record): string + } + parseAndRender(template: string, context: Record): string +} + +interface LiquidBlockTag { + type: 'block' + templates: LiquidTemplate[] + liquid: LiquidEngine | null + parse(tagToken: TagToken, remainTokens: TopLevelToken[]): void + render(scope: Record): Generator +} + +const codeTabsTemplate = '
{{ output }}
\n' +const codeTabTemplate = + '
{{ label }}
{{ output }}
\n' +const codeTabSyntax = /^(?[a-z0-9-]+)(?:\s+"(?